analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

KMSX2.zip

Full analysis: https://app.any.run/tasks/9b879911-8f21-40aa-bb64-96a6e0edb736
Verdict: Malicious activity
Analysis date: July 18, 2019, 06:44:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

ACD20E9E26C18B888A09A703220CAF72

SHA1:

EFB3895CD3B9BB8D91FBABA5954DE5E9A92E50B2

SHA256:

B366F923B9ACC9D80DE8B075F21EA4AB60333DDAE3EB22F9115A4BC7342A8166

SSDEEP:

393216:6J6XfBqGh2okF4tkRa9MTCMQyfpGeoEnTw8Ye1C2MIbHTISa:w4f9co04tkVCMEhETwS11M4zO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 2232)
      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 452)
      • ns4D07.tmp (PID: 2648)
      • ns4BAE.tmp (PID: 3516)
      • ns59FA.tmp (PID: 2284)
      • KMSpico1.exe (PID: 792)
      • ns5F0F.tmp (PID: 3616)
      • ns56EB.tmp (PID: 2828)
      • 7z.exe (PID: 3360)
      • 7z.exe (PID: 3052)
      • ns5B91.tmp (PID: 2448)
      • ns5D78.tmp (PID: 2704)
      • 7z.exe (PID: 3204)
      • ns5C8C.tmp (PID: 3404)
      • 7z.exe (PID: 2932)
      • ns5863.tmp (PID: 1828)
      • 7z.exe (PID: 4004)
      • 7z.exe (PID: 3368)
      • 7z.exe (PID: 3052)
      • 7z.exe (PID: 3412)
      • 7z.exe (PID: 3368)
      • KMSService.exe (PID: 2976)
      • 7z.exe (PID: 4000)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2372)
      • SppExtComObjPatcher.exe (PID: 3580)
      • 7z.exe (PID: 3372)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2836)
      • 7z.exe (PID: 3144)
      • nsAB05.tmp (PID: 2720)
      • KMSpico1.exe (PID: 3096)
      • 7z.exe (PID: 3796)
      • 7z.exe (PID: 2736)
      • 7z.exe (PID: 3336)
      • nsAF2F.tmp (PID: 2380)
      • nsB181.tmp (PID: 2536)
      • nsAD69.tmp (PID: 3308)
      • 7z.exe (PID: 3012)
      • nsAC7D.tmp (PID: 3768)
      • 7z.exe (PID: 3544)
      • nsA9AC.tmp (PID: 2492)
      • nsB2DA.tmp (PID: 2628)
      • nsB358.tmp (PID: 2288)
      • nsB3C7.tmp (PID: 3280)
      • 7z.exe (PID: 452)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 3308)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2392)
      • nsE1D3.tmp (PID: 3576)
      • nsE32C.tmp (PID: 3284)
      • 7z.exe (PID: 3352)
      • nsE418.tmp (PID: 4004)
      • 7z.exe (PID: 3716)
      • 7z.exe (PID: 2432)
      • nsEA94.tmp (PID: 2216)
      • 7z.exe (PID: 1632)
      • 7z.exe (PID: 2744)
      • 7z.exe (PID: 3388)
      • nsE92B.tmp (PID: 3300)
      • 7z.exe (PID: 3312)
      • nsEC5B.tmp (PID: 3544)
      • nsE570.tmp (PID: 1468)
      • 7z.exe (PID: 3692)
      • nsEB70.tmp (PID: 2812)
      • KMSpico1.exe (PID: 3532)
      • nsE6D9.tmp (PID: 2604)
      • 7z.exe (PID: 3200)
      • KMSService.exe (PID: 2292)
      • SppExtComObjPatcher.exe (PID: 3668)

    • Loads dropped or rewritten executable

      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 2232)
      • 7z.exe (PID: 3052)
      • 7z.exe (PID: 4004)
      • 7z.exe (PID: 3052)
      • 7z.exe (PID: 2932)
      • 7z.exe (PID: 3204)
      • 7z.exe (PID: 3360)
      • 7z.exe (PID: 3372)
      • 7z.exe (PID: 3144)
      • OSPPSVC.EXE (PID: 2208)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2836)
      • 7z.exe (PID: 3336)
      • 7z.exe (PID: 4000)
      • 7z.exe (PID: 2736)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2392)
      • 7z.exe (PID: 3716)
      • 7z.exe (PID: 452)
      • 7z.exe (PID: 2432)
      • 7z.exe (PID: 2744)
      • 7z.exe (PID: 3200)
      • 7z.exe (PID: 3352)
      • 7z.exe (PID: 1632)
      • OSPPSVC.EXE (PID: 2400)

    • Changes Image File Execution Options

      • KMSpico1.exe (PID: 792)
      • KMSpico1.exe (PID: 3532)

    • Loads the Task Scheduler COM API

      • OSPPSVC.EXE (PID: 2208)
      • OSPPSVC.EXE (PID: 2400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7z.exe (PID: 3360)
      • WinRAR.exe (PID: 3224)
      • 7z.exe (PID: 3204)
      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 2232)
      • KMSpico1.exe (PID: 792)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2836)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2392)
      • 7z.exe (PID: 3352)
      • KMSpico1.exe (PID: 3532)

    • Creates files in the Windows directory

      • 7z.exe (PID: 3204)
      • KMSpico1.exe (PID: 792)
      • KMSpico1.exe (PID: 3532)

    • Creates files in the user directory

      • 7z.exe (PID: 3052)
      • 7z.exe (PID: 2736)
      • 7z.exe (PID: 2744)

    • Starts application with an unusual extension

      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 2232)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2836)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2392)

    • Creates files in the program directory

      • 7z.exe (PID: 3052)
      • 7z.exe (PID: 452)
      • 7z.exe (PID: 1632)

    • Uses WMIC.EXE to obtain a system information

      • KMSpico1.exe (PID: 792)
      • KMSpico1.exe (PID: 3532)

    • Uses NETSH.EXE for network configuration

      • KMSpico1.exe (PID: 792)
      • KMSpico1.exe (PID: 3532)

    • Executed as Windows Service

      • KMSService.exe (PID: 2976)
      • SppExtComObjPatcher.exe (PID: 3580)
      • KMSService.exe (PID: 2292)
      • SppExtComObjPatcher.exe (PID: 3668)

    • Executes scripts

      • KMSpico1.exe (PID: 792)
      • KMSpico1.exe (PID: 3532)

    • Uses TASKKILL.EXE to kill process

      • KMSpico1.exe (PID: 3532)

    • Removes files from Windows directory

      • KMSpico1.exe (PID: 3532)

  • INFO

    • Manual execution by user

      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 2232)
      • ¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe (PID: 452)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2836)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2372)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 2392)
      • ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ??OFFICE???kms-bf??2018-4?汾??.exe
ZipUncompressedSize: 8067700
ZipCompressedSize: 8054581
ZipCRC: 0x0a0dabc0
ZipModifyDate: 2018:04:13 17:16:14
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
179
Monitored processes
89
Malicious processes
10
Suspicious processes
18

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe ¦¬+t+ñ+ev17.0-2019-6-22¦µ¦+.exe no specs ¦¬+t+ñ+ev17.0-2019-6-22¦µ¦+.exe ns4bae.tmp no specs 7z.exe no specs ns4d07.tmp no specs 7z.exe ns56eb.tmp no specs 7z.exe kmspico1.exe ns5863.tmp no specs 7z.exe no specs ns59fa.tmp no specs 7z.exe no specs ns5b91.tmp no specs 7z.exe no specs wmic.exe no specs ns5c8c.tmp no specs 7z.exe no specs ns5d78.tmp no specs 7z.exe no specs ns5f0f.tmp no specs 7z.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs netsh.exe no specs netsh.exe no specs kmsservice.exe no specs cscript.exe no specs sppextcomobjpatcher.exe no specs osppsvc.exe no specs ú¿office+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe no specs ú¿office+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe nsa9ac.tmp no specs 7z.exe no specs nsab05.tmp no specs 7z.exe no specs nsac7d.tmp no specs 7z.exe no specs kmspico1.exe no specs nsad69.tmp no specs 7z.exe no specs nsaf2f.tmp no specs 7z.exe no specs nsb181.tmp no specs 7z.exe no specs nsb2da.tmp no specs 7z.exe no specs nsb358.tmp no specs 7z.exe no specs nsb3c7.tmp no specs 7z.exe no specs ú¿office+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe no specs ú¿office+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe nse1d3.tmp no specs 7z.exe no specs nse32c.tmp no specs 7z.exe no specs nse418.tmp no specs 7z.exe kmspico1.exe nse570.tmp no specs 7z.exe no specs nse6d9.tmp no specs 7z.exe no specs nse92b.tmp no specs 7z.exe no specs wmic.exe no specs nsea94.tmp no specs 7z.exe no specs nseb70.tmp no specs 7z.exe no specs nsec5b.tmp no specs 7z.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs netsh.exe no specs netsh.exe no specs kmsservice.exe no specs taskkill.exe no specs cscript.exe no specs sppextcomobjpatcher.exe no specs osppsvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3224"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\KMSX2.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
452"C:\Users\admin\Desktop\¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe" C:\Users\admin\Desktop\¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2232"C:\Users\admin\Desktop\¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe" C:\Users\admin\Desktop\¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3516"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4BAE.tmp" "C:\Users\admin\AppData\Local\Temp\7z.exe" rn -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play32.dat" "UfdsvtIopuy.sys" "OTAwNT.sys"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4BAE.tmp—¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
4004"C:\Users\admin\AppData\Local\Temp\7z.exe" rn -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play32.dat" "UfdsvtIopuy.sys" "OTAwNT.sys"C:\Users\admin\AppData\Local\Temp\7z.exe—ns4BAE.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
16.02
2648"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4D07.tmp" "C:\Users\admin\AppData\Local\Temp\7z.exe" x -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play32.dat" -o"C:\Windows\system32\"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4D07.tmp—¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3204"C:\Users\admin\AppData\Local\Temp\7z.exe" x -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play32.dat" -o"C:\Windows\system32\"C:\Users\admin\AppData\Local\Temp\7z.exe
ns4D07.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
16.02
2828"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns56EB.tmp" "C:\Users\admin\AppData\Local\Temp\7z.exe" x -aoa -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play14.dat" -o"C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns56EB.tmp—¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3360"C:\Users\admin\AppData\Local\Temp\7z.exe" x -aoa -paabbccdd "C:\Users\admin\AppData\Local\Temp\Play14.dat" -o"C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\7z.exe
ns56EB.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
16.02
792C:\Users\admin\AppData\Local\Temp\KMSpico1.exeC:\Users\admin\AppData\Local\Temp\KMSpico1.exe
¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
User:
admin
Integrity Level:
HIGH
Description:
暴风一键激活工具
Exit code:
0
Version:
16.0.0.0
Total events
2 239
Read events
1 944
Write events
0
Delete events
0

Modification events

No data
Executable files
51
Suspicious files
36
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
40047z.exeC:\Users\admin\AppData\Local\Temp\Play32.dat.tmp —
MD5:—
SHA256:—
2232¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeC:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4D07.tmp —
MD5:—
SHA256:—
2232¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeC:\Users\admin\AppData\Local\Temp\Play32.datcompressed
MD5:7EE1D179B22FC2D5149ABCECAA1C915D
SHA256:3C8BC0565F3D00B96B4F2FC79224CAC81D2A8226F48E729045C86768E235E985
3224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3224.30988\ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exeexecutable
MD5:EA605CFF1C07FA04BD018439162D3A6F
SHA256:503677756C55D538C034B0B9AC27C403F52F16600C3FF9AA09C5B91FF21DE99D
3224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3224.30988\¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeexecutable
MD5:511385F38C34B117375EB51F0B0606D1
SHA256:1F1E885FFECC0CCDD584EE2F5346BBFF0ECD29EC839A8D552F8DF7B211C0EA56
2232¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeC:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns4BAE.tmpexecutable
MD5:FB24456C282F9C505192014CA00DA0D5
SHA256:79969A3511D17FAE9B1537B5C0EE0E0C06EE55D9F5F0CFD2D7B9B0A8DC7CABCA
40047z.exeC:\Users\admin\AppData\Local\Temp\Play32.datcompressed
MD5:7EE1D179B22FC2D5149ABCECAA1C915D
SHA256:3C8BC0565F3D00B96B4F2FC79224CAC81D2A8226F48E729045C86768E235E985
2232¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeC:\Users\admin\AppData\Local\Temp\nsd4B20.tmp\ns56EB.tmp —
MD5:—
SHA256:—
32047z.exeC:\Windows\system32\OTAwNT.sysexecutable
MD5:401DC161B1707A3373F656DCCC3F2164
SHA256:1AA8A8BC530A5F3F9851125C5E77BEE7EE47D45495BBB9ACCF1A2105D8CCCB5A
2232¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exeC:\Users\admin\AppData\Local\Temp\Play1.datcompressed
MD5:A8205CBF599D5703B6E10220645598B3
SHA256:FDEC594C0445A37BD06EA6C5D9321DC6B059095E1E9A415F7AC9593A886E8BA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2836
ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe
GET
—
42.51.38.18:80
http://win3.zhfcxd.com/bs4-300-4.mp3
CN
—
—
suspicious
2392
ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe
GET
—
42.51.38.18:80
http://win3.zhfcxd.com/bs4-300-4.mp3
CN
—
—
suspicious
2232
¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
GET
—
42.51.38.18:80
http://win3.zhfcxd.com/bs4-200-4.mp3
CN
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2392
ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe
42.51.38.18:80
win3.zhfcxd.com
Henan Telcom Union Technology Co., LTD
CN
suspicious
2836
ú¿OFFICE+ñ+eú¬kms-bfú¿2018-4¦µ¦+ú¬.exe
42.51.38.18:80
win3.zhfcxd.com
Henan Telcom Union Technology Co., LTD
CN
suspicious
2232
¦¬+t+ñ+eV17.0-2019-6-22¦µ¦+.exe
42.51.38.18:80
win3.zhfcxd.com
Henan Telcom Union Technology Co., LTD
CN
suspicious

DNS requests

Domain
IP
Reputation
win3.zhfcxd.com
  • 42.51.38.18
suspicious

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSX2.zip