File name:

AAct_v4.0_r1_Portable_password_2019.7z

Full analysis: https://app.any.run/tasks/fb01e085-1c8d-4bc8-9af2-132775b8465c
Verdict: Malicious activity
Analysis date: July 06, 2020, 22:31:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D64349D34B392CE8347B72AE2082C004

SHA1:

249BA8E69660B0F6CBFA44BA211BB78B28E87FD2

SHA256:

8000FEDD941024CC459C93C3DE1982529D835BF271E094630C0BF980CD96BC9E

SSDEEP:

24576:M03WymVOqZtKc2P2dNlElwwY3THR17c0MUBPePz:M/ymy5AEQ337c0MUIPz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KMSSS.exe (PID: 3164)
      • AAct.exe (PID: 1516)
      • KMSSS.exe (PID: 1564)
      • KMSSS.exe (PID: 2848)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1788)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 1944)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1232)
      • AAct.exe (PID: 1516)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2520)
      • cmd.exe (PID: 452)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 1376)
      • cmd.exe (PID: 1948)
      • cmd.exe (PID: 1476)
      • cmd.exe (PID: 3896)

    • Executes scripts

      • cmd.exe (PID: 2920)
      • cmd.exe (PID: 608)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 3348)
      • cmd.exe (PID: 3504)
      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 3740)
      • cmd.exe (PID: 2756)
      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 3076)
      • cmd.exe (PID: 960)
      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 3368)
      • cmd.exe (PID: 3440)
      • cmd.exe (PID: 2540)
      • cmd.exe (PID: 2348)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2380)
      • cmd.exe (PID: 1764)
      • cmd.exe (PID: 2116)
      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 3044)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2664)
      • AAct.exe (PID: 1516)

    • Starts CMD.EXE for commands execution

      • AAct.exe (PID: 1516)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 788)
      • cmd.exe (PID: 2616)

  • INFO

    • Manual execution by user

      • AAct.exe (PID: 1516)

    • Reads Microsoft Office registry keys

      • reg.exe (PID: 2760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
93
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe aact.exe cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs kmsss.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs netsh.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs kmsss.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs ipconfig.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs netsh.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs kmsss.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs ipconfig.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs netsh.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCPC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
472net.exe start osppsvcC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
608"C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /sdnsC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
788"C:\Windows\System32\cmd.exe" /c ipconfig.exe /flushdnsC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
920Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688C:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
960"C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Program Files\Microsoft Office\Office14\ospp.vbs" //NoLogo /actC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1024Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCPC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1024"C:\Windows\System32\cmd.exe" /c net.exe start osppsvcC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\gpapi.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\wwapi.dll
c:\windows\system32\wlanhlp.dll
c:\windows\system32\p2pcollab.dll
c:\windows\system32\p2pnetsh.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\tdh.dll
1232"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AAct_v4.0_r1_Portable_password_2019.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1236"C:\Windows\System32\cmd.exe" /c cscript.exe C:\Windows\System32\slmgr.vbs //NoLogo /atoC:\Windows\System32\cmd.exe—AAct.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 654
Read events
1 222
Write events
432
Delete events
0

Modification events

(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1232) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1232) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AAct_v4.0_r1_Portable_password_2019.7z
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1232) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
3
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1232WinRAR.exeC:\Users\admin\Desktop\AAct v4.0 r1 Portable password 2019\readme_en.txttext
MD5:35DB3ACB89F704147901B83C9BDC0B5B
SHA256:C56E528E8E536B5D71033E190B6E5B4EA735D9E76C6EB46CE3AB5BC0C23EB03E
1516AAct.exeC:\Users\admin\Desktop\AAct v4.0 r1 Portable password 2019\AAct_files\KMSSS.exeexecutable
MD5:01A80AAD5DABED1C1580F7E00213CF9D
SHA256:FD7499214ABAA13BF56D006AB7DE78EB8D6ADF17926C24ACE024D067049BC81D
1232WinRAR.exeC:\Users\admin\Desktop\AAct v4.0 r1 Portable password 2019\AAct_x64.exeexecutable
MD5:7F3DFE3836F04A1A4CAB8377FC572500
SHA256:F53A0AC49FE1EB88C937F8829B93A24BBB0B332B955BB1374046FBCEAF663E54
1232WinRAR.exeC:\Users\admin\Desktop\AAct v4.0 r1 Portable password 2019\readme_ru.txttext
MD5:97CFC67D7774B3FAC626CF36A1456528
SHA256:17FF3A22661B442DBE6437FAC5D276A152C7ADFFA65FDCC106BA60B5A3D583C0
1232WinRAR.exeC:\Users\admin\Desktop\AAct v4.0 r1 Portable password 2019\AAct.exeexecutable
MD5:A087B2E6EC57B08C0D0750C60F96A74C
SHA256:E12B6641D7E7E4DA97A0FF8E1A0D4840C882569D47B8FAB8FB187AC2B475636C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3464
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=88339
NL
—
—
whitelisted
3464
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=88340
NL
—
—
whitelisted
3464
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=88341
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120750
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120751
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120752
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120750
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120751
NL
—
—
whitelisted
2092
wmiprvse.exe
POST
302
184.25.217.162:80
http://go.microsoft.com/fwlink/?LinkID=120752
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3464
wmiprvse.exe
40.91.122.234:443
activation.sls.microsoft.com
Microsoft Corporation
US
unknown
3464
wmiprvse.exe
184.25.217.162:80
go.microsoft.com
Akamai International B.V.
NL
malicious
2092
wmiprvse.exe
40.91.122.234:443
activation.sls.microsoft.com
Microsoft Corporation
US
unknown
2092
wmiprvse.exe
184.25.217.162:80
go.microsoft.com
Akamai International B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 184.25.217.162
whitelisted
activation.sls.microsoft.com
  • 40.91.122.234
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AAct_v4.0_r1_Portable_password_2019.7z