File name:

kavremvr.exe

Full analysis: https://app.any.run/tasks/83bf62f2-b27c-480d-b5dd-1f21fee0de39
Verdict: Malicious activity
Analysis date: August 25, 2021, 19:17:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

014AAECB1A975F847474BA2C6E8D0A25

SHA1:

A507B14BE7BDD41BA22E9A943A7EC1F115917BF2

SHA256:

707B2D3DD4FC7473B0668EB8F215F623A3B61AB11069F5F885C23DD829063862

SSDEEP:

196608:8QieOU8fS6/AqNiOlfEIop4UwSDPoO+U7LyiOlf4GE7DhwgANjxfXHg:Vis8PiOlfyp4GwdiOlf4GAwbjxf3g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • kavremvr.exe (PID: 3740)
      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Application was dropped or rewritten from another process

      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Loads dropped or rewritten executable

      • kavremover.exe (PID: 4028)

    • Registers / Runs the DLL via REGSVR32.EXE

      • kavremover.exe (PID: 4028)

    • Changes the autorun value in the registry

      • regedit.exe (PID: 2248)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • kavremvr.exe (PID: 3740)
      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Drops a file that was compiled in debug mode

      • kavremvr.exe (PID: 3740)
      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Checks supported languages

      • kavremvr.exe (PID: 3740)
      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Reads the computer name

      • {41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe (PID: 3804)
      • kavremover.exe (PID: 4028)

    • Executed as Windows Service

      • kavremover.exe (PID: 4028)
      • msiexec.exe (PID: 2316)

    • Creates files in the Windows directory

      • kavremover.exe (PID: 4028)

    • Removes files from Windows directory

      • kavremover.exe (PID: 4028)

    • Creates files in the program directory

      • kavremover.exe (PID: 4028)

  • INFO

    • Checks supported languages

      • regsvr32.exe (PID: 3752)
      • regsvr32.exe (PID: 1532)
      • regsvr32.exe (PID: 3596)
      • msiexec.exe (PID: 2316)
      • regedit.exe (PID: 2248)
      • msiexec.exe (PID: 2712)

    • Reads the computer name

      • msiexec.exe (PID: 2712)
      • msiexec.exe (PID: 2316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

OriginalFileName: KAVREMVR.EXE
InternalName: KAVREMVR
FileDescription: KAV Removal Tool
FileVersion: 1.0.(1641).0
ProductVersion: 1.0.1641.0
ProductName: Kaspersky Removal Tool
LegalTrademarks: Registered trademarks and service marks are the property of their respective owners
LegalCopyright: © 2013 Kaspersky Lab ZAO. All Rights Reserved.
CompanyName: Kaspersky Lab ZAO
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.1641.0
FileVersionNumber: 1.0.1641.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x22c33
UninitializedDataSize: -
InitializedDataSize: 13535744
CodeSize: 281600
LinkerVersion: 14.16
PEType: PE32
TimeStamp: 2021:02:24 12:59:05+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-Feb-2021 11:59:05
Detected languages:
  • English - United States
  • Russian - Russia
Debug artifacts:
  • C:\a\c\d_00000000\s\product\kleaner\source\out_Win32\Release\kavremvr.pdb
CompanyName: Kaspersky Lab ZAO
LegalCopyright: © 2013 Kaspersky Lab ZAO. All Rights Reserved.
LegalTrademarks: Registered trademarks and service marks are the property of their respective owners
ProductName: Kaspersky Removal Tool
ProductVersion: 1.0.1641.0
FileVersion: 1.0.(1641).0
FileDescription: KAV Removal Tool
InternalName: KAVREMVR
OriginalFilename: KAVREMVR.EXE

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 24-Feb-2021 11:59:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00044B7C
0x00044C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.66414
.rdata
0x00046000
0x0001B3DE
0x0001B400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.44681
.data
0x00062000
0x0000757C
0x00006600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.46288
.rsrc
0x0006A000
0x00CC19D0
0x00CC1A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.71816
.reloc
0x00D2C000
0x00004420
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.58876

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.32525
1081
UNKNOWN
English - United States
RT_MANIFEST
2
2.70591
488
UNKNOWN
Russian - Russia
RT_ICON
3
2.72293
296
UNKNOWN
Russian - Russia
RT_ICON
4
3.39609
3752
UNKNOWN
Russian - Russia
RT_ICON
5
2.99642
2216
UNKNOWN
Russian - Russia
RT_ICON
6
3.04565
1736
UNKNOWN
Russian - Russia
RT_ICON
7
1.27489
1384
UNKNOWN
Russian - Russia
RT_ICON
101
6.71953
13362448
UNKNOWN
Russian - Russia
RT_RCDATA
102
2.95517
104
UNKNOWN
Russian - Russia
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
WS2_32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
10
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start kavremvr.exe {41b513ac-a389-43f6-86c5-f8255ce7e5d3}.exe kavremover.exe regsvr32.exe no specs regsvr32.exe no specs msiexec.exe no specs msiexec.exe no specs regsvr32.exe no specs regedit.exe kavremvr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1532regsvr32.exe /s vbscript.dllC:\Windows\system32\regsvr32.exe—kavremover.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2248"C:\Windows\regedit.exe" /S C:\Users\admin\AppData\Local\Temp\UnKSS2.reg C:\Windows\regedit.exe
kavremover.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2316C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2712msiexec.exe /X{56009CA3-423B-41F8-884A-E5B049534F15} /l*vx+ "C:\Users\admin\AppData\Local\Temp\kl-uninstall-2021-8-25-20-18-52.log" /QN REBOOT=ReallySuppressC:\Windows\system32\msiexec.exe—kavremover.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
1605
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3320"C:\Users\admin\AppData\Local\Temp\kavremvr.exe" C:\Users\admin\AppData\Local\Temp\kavremvr.exe—Explorer.EXE
User:
admin
Company:
Kaspersky Lab ZAO
Integrity Level:
MEDIUM
Description:
KAV Removal Tool
Exit code:
3221226540
Version:
1.0.(1641).0
Modules
Images
c:\users\admin\appdata\local\temp\kavremvr.exe
c:\windows\system32\ntdll.dll
3596regsvr32.exe /u /s "C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\basegui.ppl"C:\Windows\system32\regsvr32.exe—kavremover.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3740"C:\Users\admin\AppData\Local\Temp\kavremvr.exe" C:\Users\admin\AppData\Local\Temp\kavremvr.exe
Explorer.EXE
User:
admin
Company:
Kaspersky Lab ZAO
Integrity Level:
HIGH
Description:
KAV Removal Tool
Exit code:
0
Version:
1.0.(1641).0
Modules
Images
c:\users\admin\appdata\local\temp\kavremvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3752regsvr32.exe /s /u vbscript.dllC:\Windows\system32\regsvr32.exe—kavremover.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3804"C:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\{41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe" ?C:\Users\admin\AppData\Local\Temp?C:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\{41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exe
kavremvr.exe
User:
admin
Company:
Kaspersky Lab ZAO
Integrity Level:
HIGH
Description:
KAV Removal Tool
Exit code:
16533032
Version:
1.0.(1641).0
Modules
Images
c:\users\admin\appdata\local\temp\{091985ce-35ce-4358-8c00-327b33022a19}\{41b513ac-a389-43f6-86c5-f8255ce7e5d3}.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
4028C:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\kavremover.exe
services.exe
User:
SYSTEM
Company:
Kaspersky Lab ZAO
Integrity Level:
SYSTEM
Description:
Removal Tool
Exit code:
0
Version:
1.0.(1641).0
Modules
Images
c:\users\admin\appdata\local\temp\{091985ce-35ce-4358-8c00-327b33022a19}\kavremover.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
Total events
829
Read events
821
Write events
8
Delete events
0

Modification events

(PID) Process:(4028) kavremover.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(4028) kavremover.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(4028) kavremover.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2248) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:UnKSS2
Value:
wscript.exe //b C:\Users\admin\AppData\Local\Temp\UnKSS2.vbs
(PID) Process:(4028) kavremover.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B} {000214FC-0000-0000-C000-000000000046} 0xFFFF
Value:
010000000000000023738C0CE699D701
(PID) Process:(4028) kavremover.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF
Value:
010000000000000023738C0CE699D701
Executable files
4
Suspicious files
1
Text files
94
Unknown types
0

Dropped files

PID
Process
Filename
Type
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\inidata.dllexecutable
MD5:—
SHA256:—
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df6.initext
MD5:—
SHA256:—
3804{41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\kavremover.exeexecutable
MD5:—
SHA256:—
3740kavremvr.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\{41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exeexecutable
MD5:—
SHA256:—
3804{41B513AC-A389-43F6-86C5-F8255CE7E5D3}.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\dbghelp.dllexecutable
MD5:3D512C7653930257D840F7469452224D
SHA256:F7EFF391E679D57143A534C8785B6D48DC04D51FF83FF7312DFE6655ABC4CA2F
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df5.initext
MD5:EA02142333462C626EFF570BFC9A9495
SHA256:DB170B1740A973DBAA407E5A36A344D0BF6D205714261444770797DBCCF35E52
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df1.initext
MD5:494AABC7895A68C7B815523BD574D1BF
SHA256:1FCDD5947FA33F20D7D5007479395E91456B6D65AEB51FBF22396198EBEE0DF8
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df7.initext
MD5:DFC6086144949E8D4AC9B7DB2A02DA1F
SHA256:DBD4259898F8D6DA28A63957ECDFD3C0B11BF77C4FA8F2A0ECA348CE1D60F2FA
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df0.initext
MD5:7739C893A7CBF345C5CA1EE6438D6777
SHA256:C1252B4747127891B671D95E568A210AC5947FF27DFE067149854B5F8B804849
4028kavremover.exeC:\Users\admin\AppData\Local\Temp\{091985CE-35CE-4358-8C00-327B33022A19}\jkbasuy1\xthth\df8.initext
MD5:943ED9C8A8BCB9B2F8DE36DF8F34CCED
SHA256:7AE7AA8B07D9D1A1BAD2E72E7543A1E015FAECA5DDC3ED12FC35C7C6A533CDC3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kavremvr.exe