File name:

KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip

Full analysis: https://app.any.run/tasks/f47cfdf6-25bd-45cd-9691-ddadcf95e267
Verdict: Malicious activity
Analysis date: August 30, 2020, 18:46:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

146C2759347E0D52625CCB4076E97EBB

SHA1:

37A5E26C83CDD143C9265AB454196A4AFC6FF79E

SHA256:

322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36

SSDEEP:

196608:dhAfd4e3KegPHGl9sDgXWEtydP0QLFjReeoSuANd+BOJMuMmeu2iOQhNO+Qu7Yy5:dhe2lnmoEXWEw+8FFeeKduuu2hztu7YM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KMSAuto Net.exe (PID: 2828)
      • KMSAuto Net 1.5.1.exe (PID: 4008)
      • KMSAuto Net.exe (PID: 2488)
      • KMSAuto Net 1.5.1.exe (PID: 2680)
      • AESDecoder.exe (PID: 3356)
      • bin.dat (PID: 3868)
      • KMSSS.exe (PID: 4032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3380)
      • KMSAuto Net.exe (PID: 2488)
      • bin.dat (PID: 3868)
      • bin_x86.dat (PID: 3040)
      • AESDecoder.exe (PID: 3356)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 2488)
      • cmd.exe (PID: 2836)

    • Starts CMD.EXE for self-deleting

      • KMSAuto Net.exe (PID: 2488)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 2808)

    • Reads internet explorer settings

      • KMSAuto Net.exe (PID: 2488)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 2488)

    • Creates files in the program directory

      • KMSAuto Net.exe (PID: 2488)
      • bin.dat (PID: 3868)
      • AESDecoder.exe (PID: 3356)
      • bin_x86.dat (PID: 3040)
      • KMSSS.exe (PID: 4032)

    • Application launched itself

      • cmd.exe (PID: 2836)

    • Uses NETSH.EXE for network configuration

      • KMSAuto Net.exe (PID: 2488)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 2488)

    • Creates or modifies windows services

      • KMSAuto Net.exe (PID: 2488)

    • Executed as Windows Service

      • KMSSS.exe (PID: 4032)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 3300)

    • Uses REG.EXE to modify Windows registry

      • KMSAuto Net.exe (PID: 2488)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: KMSAuto Net 2016 1.4.9 Portable + 1.5.1/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2017:10:11 22:05:07
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
40
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start winrar.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs bin.dat cmd.exe no specs cmd.exe no specs aesdecoder.exe cmd.exe no specs cmd.exe no specs bin_x86.dat cmd.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3380"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2680"C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe—WinRAR.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
MEDIUM
Description:
KMSAuto Net
Exit code:
3221226540
Version:
1.5.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3380.8143\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net 1.5.1.exe
c:\systemroot\system32\ntdll.dll
4008"C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe
WinRAR.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
HIGH
Description:
KMSAuto Net
Exit code:
0
Version:
1.5.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3380.8143\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net 1.5.1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2828"C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe—WinRAR.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
MEDIUM
Description:
KMSAuto Net
Exit code:
3221226540
Version:
1.4.9
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3380.9558\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net.exe
c:\systemroot\system32\ntdll.dll
2488"C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe
WinRAR.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
HIGH
Description:
KMSAuto Net
Version:
1.4.9
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3380.9558\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1352cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc"C:\Windows\system32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2816cmd /c echo test>>"C:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\test.test"C:\Windows\system32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1384C:\Windows\System32\cmd.exe /D /c del /F /Q "test.test"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2852C:\Windows\System32\cmd.exe /D /c md "C:\ProgramData\KMSAuto"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3032C:\Windows\System32\cmd.exe /D /c bin.dat -y -pkmsautoC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
688
Read events
551
Write events
129
Delete events
8

Modification events

(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
18
Suspicious files
5
Text files
96
Unknown types
5

Dropped files

PID
Process
Filename
Type
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_fr.txttext
MD5:474FB9BCC634EA9BC1F2B77382A0D03B
SHA256:D0B8BBE89016B3E05FF1C376C9A3CCE7CA2E4070BFFC11BFD9A91808B6DC060C
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_bg.txttext
MD5:D6761E218D57B85236345F74EA44A684
SHA256:E03107D2DEC7EB59033B4D0CACF9DD320C3BE1D9389295F87F069E667F138201
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_cn.txttext
MD5:67FA7B665E63269A86043ABA1C462EFA
SHA256:752D7FF42C648AFAC4D40A418512DB6E49896FA24BB1949442DDF50FF64B01AA
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_ru.txttext
MD5:9024969540F646D708D921640A9B98A7
SHA256:996076E53F85FC0C818D09C97902864EB2CBB0E58D519C795CEAB09308749A91
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_en.txttext
MD5:2A710AB80A87F13F5AED664D04E5C6A6
SHA256:F9F41A1ADF235066F7B1C477CAE36A7AE9C344E7DEF7059A9148E74669809924
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_kms.txttext
MD5:352709B6AED3902D4399F6615A7A7E70
SHA256:D3BEF0FEF19603B33B86E1CA431A25CB8A6DF047058E073BBF8BB931533217AA
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exeexecutable
MD5:93A3A8CE440197D31168FAC569082937
SHA256:22EF521964080E77D7006F9341D720683FA98409361C62A7BC4FE81EC474B1B2
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_ru.txttext
MD5:9024969540F646D708D921640A9B98A7
SHA256:996076E53F85FC0C818D09C97902864EB2CBB0E58D519C795CEAB09308749A91
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_es.txttext
MD5:A99B01CEFE99E1DBCE3285F625320A43
SHA256:8B422282263EFC65C9F688F78632D8F931AC27E58FAFCBA49A7A9F1DCE012D1D
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_fr.txttext
MD5:474FB9BCC634EA9BC1F2B77382A0D03B
SHA256:D0B8BBE89016B3E05FF1C376C9A3CCE7CA2E4070BFFC11BFD9A91808B6DC060C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip