File name:

kmspico.zip

Full analysis: https://app.any.run/tasks/65918678-ded4-4c35-9a27-b62eed6ec67c
Verdict: Malicious activity
Analysis date: May 01, 2024, 18:05:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

30763DFD41EB47094AC3F3CD3A8A1C0A

SHA1:

829E65A0C418FC4C492BBF9F423DB209FB337699

SHA256:

680AA9E05C7A2F5B0F69A05607A20C27DD78BE486F00E8513C58A00E88DA8196

SSDEEP:

98304:kuLvK6pFzvTI95yJoM++IJYxsusnY3FYTsJpfQPKb9M+vZ8gdQEq2LFnoRLV/dpZ:MV4F84iC2+c3v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KMSpico-setup.exe (PID: 1020)
      • KMSpico-setup.exe (PID: 2012)
      • KMSpico-setup.tmp (PID: 1080)

    • Creates a writable file in the system directory

      • KMSpico-setup.tmp (PID: 1080)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3964)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 3964)

    • Application launched itself

      • WinRAR.exe (PID: 3964)

    • Executable content was dropped or overwritten

      • KMSpico-setup.exe (PID: 1020)
      • KMSpico-setup.exe (PID: 2012)
      • KMSpico-setup.tmp (PID: 1080)

    • Reads the Windows owner or organization settings

      • KMSpico-setup.tmp (PID: 1080)

    • Process drops legitimate windows executable

      • KMSpico-setup.tmp (PID: 1080)

    • Starts CMD.EXE for commands execution

      • KMSpico-setup.tmp (PID: 1080)

    • Modifies the phishing filter of IE

      • KMSpico-setup.tmp (PID: 1080)

    • Executing commands from ".cmd" file

      • KMSpico-setup.tmp (PID: 1080)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2092)

    • Creates or modifies Windows services

      • KMSELDI.exe (PID: 2364)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4020)

    • Manual execution by a user

      • KMSpico-setup.exe (PID: 1020)
      • wmpnscfg.exe (PID: 956)
      • KMSELDI.exe (PID: 2976)
      • KMSELDI.exe (PID: 2916)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4020)

    • Checks supported languages

      • KMSpico-setup.exe (PID: 1020)
      • KMSpico-setup.tmp (PID: 2108)
      • KMSpico-setup.exe (PID: 2012)
      • KMSpico-setup.tmp (PID: 1080)
      • UninsHs.exe (PID: 1844)
      • KMSELDI.exe (PID: 2364)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)
      • wmpnscfg.exe (PID: 956)

    • Create files in a temporary directory

      • KMSpico-setup.exe (PID: 1020)
      • KMSpico-setup.exe (PID: 2012)
      • KMSpico-setup.tmp (PID: 1080)

    • Reads the computer name

      • KMSpico-setup.tmp (PID: 2108)
      • KMSpico-setup.tmp (PID: 1080)
      • KMSELDI.exe (PID: 2364)
      • wmpnscfg.exe (PID: 956)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)

    • Creates files in the program directory

      • KMSpico-setup.tmp (PID: 1080)
      • KMSELDI.exe (PID: 2364)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)

    • Creates a software uninstall entry

      • KMSpico-setup.tmp (PID: 1080)

    • Reads the machine GUID from the registry

      • KMSELDI.exe (PID: 2364)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)

    • Reads Environment values

      • KMSELDI.exe (PID: 2364)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)

    • Reads product name

      • KMSELDI.exe (PID: 2364)
      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)

    • Reads Microsoft Office registry keys

      • AutoPico.exe (PID: 2664)
      • KMSELDI.exe (PID: 2976)
      • KMSELDI.exe (PID: 2364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:10:13 21:17:00
ZipCRC: 0xae68121a
ZipCompressedSize: 3194923
ZipUncompressedSize: 3194923
ZipFileName: KMSPico-SetupFile.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
17
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs winrar.exe kmspico-setup.exe kmspico-setup.tmp no specs kmspico-setup.exe kmspico-setup.tmp uninshs.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs sc.exe no specs kmseldi.exe wmpnscfg.exe no specs autopico.exe kmseldi.exe no specs kmseldi.exe

Process information

PID
CMD
Path
Indicators
Parent process
580SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
956"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\Desktop\KMSpico-setup.exe" C:\Users\admin\Desktop\KMSpico-setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\desktop\kmspico-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1080"C:\Users\admin\AppData\Local\Temp\is-VC4U0.tmp\KMSpico-setup.tmp" /SL5="$401A0,2952592,69120,C:\Users\admin\Desktop\KMSpico-setup.exe" /SPAWNWND=$3019E /NOTIFYWND=$301BA C:\Users\admin\AppData\Local\Temp\is-VC4U0.tmp\KMSpico-setup.tmp
KMSpico-setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-vc4u0.tmp\kmspico-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1548sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1844"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\admin\Desktop\KMSpico-setup.exeC:\Program Files\KMSpico\UninsHs.exe—KMSpico-setup.tmp
User:
admin
Company:
Han-soft
Integrity Level:
HIGH
Description:
Uninstall for InnoSetup by Han-soft
Exit code:
0
Version:
2.1.0.283
Modules
Images
c:\program files\kmspico\uninshs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1948"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""C:\Windows\System32\cmd.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2012"C:\Users\admin\Desktop\KMSpico-setup.exe" /SPAWNWND=$3019E /NOTIFYWND=$301BA C:\Users\admin\Desktop\KMSpico-setup.exe
KMSpico-setup.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\desktop\kmspico-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2092"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""C:\Windows\System32\cmd.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2108"C:\Users\admin\AppData\Local\Temp\is-M4DR8.tmp\KMSpico-setup.tmp" /SL5="$301BA,2952592,69120,C:\Users\admin\Desktop\KMSpico-setup.exe" C:\Users\admin\AppData\Local\Temp\is-M4DR8.tmp\KMSpico-setup.tmp—KMSpico-setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-m4dr8.tmp\kmspico-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
16 829
Read events
16 699
Write events
120
Delete events
10

Modification events

(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3964) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\kmspico.zip
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
22
Suspicious files
35
Text files
717
Unknown types
1

Dropped files

PID
Process
Filename
Type
4020WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4020.6026\KMSPico-SetupFile\KMSpico-setup.exeexecutable
MD5:A02164371A50C5FF9FA2870EF6E8CFA3
SHA256:64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A
2012KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-VC4U0.tmp\KMSpico-setup.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
1080KMSpico-setup.tmpC:\Users\admin\AppData\Local\Temp\is-CQL1D.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
1080KMSpico-setup.tmpC:\Program Files\KMSpico\is-EO776.tmpexecutable
MD5:CFE1C391464C446099A5EB33276F6D57
SHA256:4A714D98CE40F5F3577C306A66CB4A6B1FF3FD01047C7F4581F8558F0BCDF5FA
1080KMSpico-setup.tmpC:\Program Files\KMSpico\DevComponents.DotNetBar2.dllexecutable
MD5:1397B23F30681F97049DF61F94F54D05
SHA256:FA76151A783250014AC8FA55D4C833100A623FCAD1D6E2DDADCDE259F5709609
1080KMSpico-setup.tmpC:\Program Files\KMSpico\is-HJAG5.tmpexecutable
MD5:30C7E8E918403B9247315249A8842CE5
SHA256:6D4FA6727CA952B7B44FA9F3538D84B64E06C76908C76FADE7846532A7115A49
1080KMSpico-setup.tmpC:\Program Files\KMSpico\unins000.exeexecutable
MD5:30C7E8E918403B9247315249A8842CE5
SHA256:6D4FA6727CA952B7B44FA9F3538D84B64E06C76908C76FADE7846532A7115A49
1080KMSpico-setup.tmpC:\Program Files\KMSpico\Vestris.ResourceLib.dllexecutable
MD5:3D733144477CADCF77009EF614413630
SHA256:392D73617FD0A55218261572ECE2F50301E0CFA29B5ED24C3F692130AA406AF3
3964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3964.5687\KMSPico-SetupFile.zipcompressed
MD5:FA130CD79EA172B362913FA4C8728EAA
SHA256:DA0821D7C85BA91BB55F1747208BFF62A0B70F8838213FE37554D317DB6355F9
3964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3964.5175\Password.txttext
MD5:B18FC19CE749B90816437307D6D01250
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2364
KMSELDI.exe
88.198.226.248:123
2.pool.ntp.org
—
—
unknown
2664
AutoPico.exe
176.9.44.212:123
0.pool.ntp.org
—
—
unknown
2976
KMSELDI.exe
185.207.105.38:123
1.pool.ntp.org
—
—
unknown

DNS requests

Domain
IP
Reputation
2.pool.ntp.org
  • 162.159.200.1
  • 213.209.109.45
  • 88.198.226.248
  • 158.101.188.125
whitelisted
0.pool.ntp.org
  • 188.40.128.242
  • 176.9.44.212
  • 17.253.14.251
  • 75.119.140.230
whitelisted
1.pool.ntp.org
  • 85.215.93.134
  • 144.76.76.107
  • 144.76.43.40
  • 185.207.105.38
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kmspico.zip