File name:

KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip

Full analysis: https://app.any.run/tasks/f47cfdf6-25bd-45cd-9691-ddadcf95e267
Verdict: Malicious activity
Analysis date: August 30, 2020, 18:46:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

146C2759347E0D52625CCB4076E97EBB

SHA1:

37A5E26C83CDD143C9265AB454196A4AFC6FF79E

SHA256:

322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36

SSDEEP:

196608:dhAfd4e3KegPHGl9sDgXWEtydP0QLFjReeoSuANd+BOJMuMmeu2iOQhNO+Qu7Yy5:dhe2lnmoEXWEw+8FFeeKduuu2hztu7YM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KMSAuto Net 1.5.1.exe (PID: 2680)
      • KMSAuto Net 1.5.1.exe (PID: 4008)
      • KMSAuto Net.exe (PID: 2488)
      • KMSAuto Net.exe (PID: 2828)
      • bin.dat (PID: 3868)
      • AESDecoder.exe (PID: 3356)
      • KMSSS.exe (PID: 4032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3380)
      • KMSAuto Net.exe (PID: 2488)
      • bin.dat (PID: 3868)
      • AESDecoder.exe (PID: 3356)
      • bin_x86.dat (PID: 3040)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 2488)
      • cmd.exe (PID: 2836)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 2488)

    • Starts CMD.EXE for self-deleting

      • KMSAuto Net.exe (PID: 2488)

    • Reads internet explorer settings

      • KMSAuto Net.exe (PID: 2488)

    • Creates files in the program directory

      • KMSAuto Net.exe (PID: 2488)
      • bin.dat (PID: 3868)
      • AESDecoder.exe (PID: 3356)
      • KMSSS.exe (PID: 4032)
      • bin_x86.dat (PID: 3040)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 2808)

    • Application launched itself

      • cmd.exe (PID: 2836)

    • Executed as Windows Service

      • KMSSS.exe (PID: 4032)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 3300)

    • Uses NETSH.EXE for network configuration

      • KMSAuto Net.exe (PID: 2488)

    • Creates or modifies windows services

      • KMSAuto Net.exe (PID: 2488)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 2488)

    • Uses REG.EXE to modify Windows registry

      • KMSAuto Net.exe (PID: 2488)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2017:10:11 22:05:07
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: KMSAuto Net 2016 1.4.9 Portable + 1.5.1/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
40
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start winrar.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs bin.dat cmd.exe no specs cmd.exe no specs aesdecoder.exe cmd.exe no specs cmd.exe no specs bin_x86.dat cmd.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\Windows\System32\cmd.exe /D /c del /F /Q "AESDecoder.exe"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
560C:\Windows\System32\Netsh Advfirewall Firewall delete rule name="0pen Port KMS" protocol=TCPC:\Windows\System32\Netsh.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
888C:\Windows\System32\cmd.exe /D /c del /F /Q "bin_x86.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
928C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1120C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1324C:\Windows\System32\sc start KMSEmulatorC:\Windows\System32\sc.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1056
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1352cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc"C:\Windows\system32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1384C:\Windows\System32\cmd.exe /D /c del /F /Q "test.test"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1692C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59A52881-A989-479D-AF46-F275C6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1940C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
Total events
688
Read events
551
Write events
129
Delete events
8

Modification events

(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3380) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3380) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
18
Suspicious files
5
Text files
96
Unknown types
5

Dropped files

PID
Process
Filename
Type
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exeexecutable
MD5:93A3A8CE440197D31168FAC569082937
SHA256:22EF521964080E77D7006F9341D720683FA98409361C62A7BC4FE81EC474B1B2
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exeexecutable
MD5:2FB86BE791B4BB4389E55DF0FEC04EB7
SHA256:B8AEC57F7E9C193FCD9796CF22997605624B8B5F9BF5F0C6190E1090D426EE31
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_ua.txttext
MD5:D2DBDCDD45DB12313A758F70F3214CFB
SHA256:4E6E727F2608ABB0BDCE88395952F32088C94CBBFD46AC3FE332705CA02F484A
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_ru.txttext
MD5:9024969540F646D708D921640A9B98A7
SHA256:996076E53F85FC0C818D09C97902864EB2CBB0E58D519C795CEAB09308749A91
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_cn.txttext
MD5:67FA7B665E63269A86043ABA1C462EFA
SHA256:752D7FF42C648AFAC4D40A418512DB6E49896FA24BB1949442DDF50FF64B01AA
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.8143\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_fr.txttext
MD5:474FB9BCC634EA9BC1F2B77382A0D03B
SHA256:D0B8BBE89016B3E05FF1C376C9A3CCE7CA2E4070BFFC11BFD9A91808B6DC060C
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exeexecutable
MD5:93A3A8CE440197D31168FAC569082937
SHA256:22EF521964080E77D7006F9341D720683FA98409361C62A7BC4FE81EC474B1B2
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_ru.txttext
MD5:9024969540F646D708D921640A9B98A7
SHA256:996076E53F85FC0C818D09C97902864EB2CBB0E58D519C795CEAB09308749A91
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exeexecutable
MD5:2FB86BE791B4BB4389E55DF0FEC04EB7
SHA256:B8AEC57F7E9C193FCD9796CF22997605624B8B5F9BF5F0C6190E1090D426EE31
3380WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3380.9558\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_bg.txttext
MD5:D6761E218D57B85236345F74EA44A684
SHA256:E03107D2DEC7EB59033B4D0CACF9DD320C3BE1D9389295F87F069E667F138201
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip