File name:

KMSAuto-Net-Portable.zip

Full analysis: https://app.any.run/tasks/250fa4a6-c4f7-4add-94d2-2bea86f7224f
Verdict: Malicious activity
Analysis date: May 13, 2021, 21:46:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

D5F0B8A8226B93BC7C0831D6ECFDE9C2

SHA1:

6DF9ADFFBF5B05D4B75722648DC5F9FCA7234BE3

SHA256:

433DE55803735012238B1549E844597F6788E1979E9F1D5FDB15FC4509FB5A47

SSDEEP:

393216:c19sGUW6X2bHmDmsxaIVcIEsJM2r6oqU73MmC9o:+CW6GcmC+1sJ1qAnC9o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2160)
      • signtool.exe (PID: 2372)
      • KMSAuto.exe (PID: 2724)
      • KMSAuto.exe (PID: 2504)
      • signtool.exe (PID: 2456)

    • Drops executable file immediately after starts

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2504)

    • Changes settings of System certificates

      • signtool.exe (PID: 2372)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 952)
      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2504)

    • Starts CMD.EXE for commands execution

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2504)

    • Drops a file that was compiled in debug mode

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2504)

    • Uses WMIC.EXE to obtain a system information

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2504)

    • Adds / modifies Windows certificates

      • signtool.exe (PID: 2372)

  • INFO

    • Manual execution by user

      • KMSAuto.exe (PID: 1968)
      • KMSAuto.exe (PID: 2160)
      • KMSAuto.exe (PID: 2724)
      • KMSAuto.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: KMSAuto-Net-1.5.4/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:11:10 21:42:08
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
14
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe kmsauto.exe no specs kmsauto.exe cmd.exe no specs signtool.exe wmic.exe no specs kmsauto.exe no specs kmsauto.exe cmd.exe no specs signtool.exe wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
952"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\KMSAuto-Net-Portable.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1688"wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:ListC:\Windows\System32\Wbem\wmic.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1732"wmic.exe" path SoftwareLicensingService where Version='6.1.7601.17514' call InstallProductKey ProductKey="FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4"C:\Windows\System32\Wbem\wmic.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1912"wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:ListC:\Windows\System32\Wbem\wmic.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
1968"C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe" C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\kmsauto-lite-1.5.6\kmsauto.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2020"C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\admin\AppData\Local\Temp\KMSAuto.tmp" /YC:\Windows\System32\cmd.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2160"C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe" C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\kmsauto-lite-1.5.6\kmsauto.exe
c:\systemroot\system32\ntdll.dll
2372"C:\Users\admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe"C:\Users\admin\AppData\Local\Temp\signtool.exe
KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Authenticode(R) - signing and verifying tool
Exit code:
1
Version:
4.00 (rs1_release_sec.170105-1850)
Modules
Images
c:\users\admin\appdata\local\temp\signtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\user32.dll
2456"C:\Users\admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\admin\Desktop\KMSAuto-Lite-1.5.6\KMSAuto.exe"C:\Users\admin\AppData\Local\Temp\signtool.exe
KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Authenticode(R) - signing and verifying tool
Exit code:
1
Version:
4.00 (rs1_release_sec.170105-1850)
Modules
Images
c:\users\admin\appdata\local\temp\signtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\user32.dll
2472"wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Windows%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:ListC:\Windows\System32\Wbem\wmic.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
595
Read events
560
Write events
35
Delete events
0

Modification events

(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(952) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(952) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto-Net-Portable.zip
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(952) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
4
Suspicious files
6
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Cab8E17.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Tar8E18.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Cab8EA6.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Tar8EA7.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Cab8FD1.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Tar8FD2.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Cab96F7.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Tar96F8.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Tar9719.tmp —
MD5:—
SHA256:—
2372signtool.exeC:\Users\admin\AppData\Local\Temp\Cab97D6.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2372
signtool.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
58.4 Kb
whitelisted
2372
signtool.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
58.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2456
signtool.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2372
signtool.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto-Net-Portable.zip