File name:

kmsautonet.zip

Full analysis: https://app.any.run/tasks/42bb72ed-ef4b-4372-9b33-cbb4ba66fe65
Verdict: Malicious activity
Analysis date: July 28, 2020, 07:45:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

7ACBE962D3FABE645251EA8563D65BB4

SHA1:

F032DCF8FD16E3A9757CB19C1E0FEBB9729C84B5

SHA256:

3B645D5AA6A32F0BCFE9AC0C04DEBEBF41740E14E8364D8962A5589792359094

SSDEEP:

98304:iGPoQJYWYOmnxhc597jSbByUQ9f/730/DJcBVBGlsW0VuhIBLE4Zo1RohX3uSJ3+:Ci6O8xhcn7mN85iCglXyqQLEiGRohuW+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • certmgr.exe (PID: 3784)
      • certmgr.exe (PID: 2336)

    • Application was dropped or rewritten from another process

      • certmgr.exe (PID: 3784)
      • certmgr.exe (PID: 2336)
      • AESDecoder.exe (PID: 556)
      • KMSAuto Net.exe (PID: 1824)
      • KMSSS.exe (PID: 1684)
      • KMSAuto Net.exe (PID: 3392)

  • SUSPICIOUS

    • Reads Environment values

      • KMSAuto Net.exe (PID: 3392)

    • Starts CMD.EXE for self-deleting

      • KMSAuto Net.exe (PID: 3392)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1496)
      • cmd.exe (PID: 2072)
      • cmd.exe (PID: 3728)

    • Reads internet explorer settings

      • KMSAuto Net.exe (PID: 3392)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 3392)
      • cmd.exe (PID: 3420)

    • Creates files in the program directory

      • KMSAuto Net.exe (PID: 3392)
      • wzt.dat (PID: 252)
      • bin.dat (PID: 3988)
      • AESDecoder.exe (PID: 556)
      • KMSSS.exe (PID: 1684)
      • bin_x86.dat (PID: 340)

    • Executable content was dropped or overwritten

      • wzt.dat (PID: 252)
      • bin.dat (PID: 3988)
      • AESDecoder.exe (PID: 556)
      • bin_x86.dat (PID: 340)
      • KMSAuto Net.exe (PID: 3392)

    • Uses NETSH.EXE for network configuration

      • KMSAuto Net.exe (PID: 3392)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 3848)

    • Creates or modifies windows services

      • KMSAuto Net.exe (PID: 3392)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 3392)

    • Executed as Windows Service

      • KMSSS.exe (PID: 1684)

    • Uses REG.EXE to modify Windows registry

      • KMSAuto Net.exe (PID: 3392)

  • INFO

    • Manual execution by user

      • KMSAuto Net.exe (PID: 3392)
      • KMSAuto Net.exe (PID: 1824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:07:27 11:51:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: kmsautonet/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
39
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs wzt.dat cmd.exe no specs cmd.exe no specs certmgr.exe no specs cmd.exe no specs certmgr.exe no specs cmd.exe no specs cmd.exe no specs bin.dat cmd.exe no specs cmd.exe no specs aesdecoder.exe cmd.exe no specs cmd.exe no specs bin_x86.dat cmd.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252wzt.dat -y -pkmsautoC:\ProgramData\KMSAuto\wzt.dat
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\kmsauto\wzt.dat
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
296C:\Windows\System32\Netsh Advfirewall Firewall delete rule name="0pen Port KMS" protocol=TCPC:\Windows\System32\Netsh.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
340bin_x86.dat -y -pkmsautoC:\ProgramData\KMSAuto\bin_x86.dat
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\kmsauto\bin_x86.dat
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
556AESDecoder.exeC:\ProgramData\KMSAuto\bin\AESDecoder.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\kmsauto\bin\aesdecoder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
564C:\Windows\System32\cmd.exe /c echo test>>"C:\Users\admin\Desktop\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\test.test"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1020"C:\Windows\System32\cmd.exe" /c rd "C:\ProgramData\KMSAuto\wzt" /S /QC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1336C:\Windows\System32\cmd.exe /D /c certmgr.exe -add wzteam.cer -n wzteam -s -r localMachine TRUSTEDPUBLISHERC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1372C:\Windows\System32\Netsh Advfirewall Firewall add rule name="0pen Port KMS" dir=in action=allow protocol=TCP localport=1688C:\Windows\System32\Netsh.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1400C:\Windows\System32\cmd.exe /D /c del /F /Q "AESDecoder.exe"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1496C:\Windows\System32\cmd.exe /D /c wzt.dat -y -pkmsautoC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
695
Read events
570
Write events
121
Delete events
4

Modification events

(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1900) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\kmsautonet.zip
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1900) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(1900) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
14
Suspicious files
4
Text files
21
Unknown types
5

Dropped files

PID
Process
Filename
Type
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\KMSAuto Net.exe —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_bg.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_cn.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_en.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_es.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_fr.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_kms.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_ru.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_ua.txt —
MD5:—
SHA256:—
1900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1900.16812\kmsautonet\KMSAuto Net 2016 v1.5.4 Portable\readme\readme_vi.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kmsautonet.zip