| download: | Windows_KMS_Activator_Ultimate_2019_4.5_Setup.sanet.st.rar |
| Full analysis: | https://app.any.run/tasks/a42faae5-0b9d-4806-8b84-9a9ff47a21fa |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | February 10, 2019, 17:24:29 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | C539EB9B7EB17E2D0101D355B15B089A |
| SHA1: | 2DA277738634AD08F098676BE448CCEE33F22C86 |
| SHA256: | B8AA2C07E6086E94A3C71AA3336C7816886C3D39871ABF6CFAD9378E1C0717D4 |
| SSDEEP: | 196608:McIiMIKF1p253DBU06KJPVNT/ycVXYYy5oivB7W:McIiMNXC609B3hfMB6 |
MALICIOUS
Application was dropped or rewritten from another process
- Windows KMS Activator Ultimate 2019 4.5 Setup.exe (PID: 2964)
- Windows KMS Activator Ultimate 2019 4.5 Setup.exe (PID: 2908)
- Windows KMS Activator Ultimate 2019 4.5.exe (PID: 3844)
- Windows KMS Activator Ultimate 2019 4.5.exe (PID: 3688)
Adds new firewall rule via NETSH.EXE
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3108)
- Windows KMS Activator Ultimate 2019 4.5 Setup.exe (PID: 2964)
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
- Windows KMS Activator Ultimate 2019 4.5 Setup.exe (PID: 2908)
Creates files in the Windows directory
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
Uses NETSH.EXE for network configuration
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
Executes scripts
- cmd.exe (PID: 3156)
- cmd.exe (PID: 3208)
- cmd.exe (PID: 2588)
- cmd.exe (PID: 1940)
- cmd.exe (PID: 4040)
- cmd.exe (PID: 1888)
- cmd.exe (PID: 3012)
- cmd.exe (PID: 2252)
- cmd.exe (PID: 3704)
- cmd.exe (PID: 4028)
- cmd.exe (PID: 1488)
- cmd.exe (PID: 2552)
Starts CMD.EXE for commands execution
- Windows KMS Activator Ultimate 2019 4.5.exe (PID: 3844)
Modifies the phishing filter of IE
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
Creates files like Ransomware instruction
- WinRAR.exe (PID: 3108)
INFO
Application was dropped or rewritten from another process
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3820)
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
Creates a software uninstall entry
- Windows KMS Activator Ultimate 2019 4.5 Setup.tmp (PID: 3560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 8368373 |
|---|---|
| UncompressedSize: | 10361308 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2019:02:02 13:15:17 |
| PackingMethod: | Best Compression |
| ArchivedFileName: | Windows KMS Activator Ultimate 2019 4.5 Setup.exe |
Total processes
85
Monitored processes
32
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1488 | cmd /c slmgr -ckms //B | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1888 | cmd.exe /C start slmgr.vbs -rilc //B | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1912 | "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ATO //B | C:\Windows\System32\WScript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1940 | cmd.exe /C start slmgr /cpky //B | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2252 | cmd.exe /C slmgr -XPR | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2552 | "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /cpky //B | C:\Windows\System32\WScript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2552 | cmd.exe /C slmgr -XPR | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2588 | cmd /c slmgr -upk //B | C:\Windows\system32\cmd.exe | — | Windows KMS Activator Ultimate 2019 4.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2600 | "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /IPK FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4 //B | C:\Windows\System32\WScript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2612 | "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" -ckms //B | C:\Windows\System32\WScript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
Total events
1 721
Read events
1 545
Write events
170
Delete events
6
Modification events
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Windows_KMS_Activator_Ultimate_2019_4.5_Setup.sanet.st.rar | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
| (PID) Process: | (3108) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB0000000440000007004000039020000 | |||
Executable files
6
Suspicious files
0
Text files
4
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\is-S98QH.tmp | — | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\is-HS6IP.tmp | — | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\is-T8HDD.tmp | — | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\is-UJTOP.tmp | — | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\is-FVIGS.tmp | — | |
MD5:— | SHA256:— | |||
| 3108 | WinRAR.exe | C:\Users\admin\Desktop\Readme.txt | text | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\Readme.txt | text | |
MD5:— | SHA256:— | |||
| 3560 | Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | C:\Windows KMS Activator Ultimate 2019 4.5\Windows KMS Activator Ultimate 2019 4.5.exe | executable | |
MD5:— | SHA256:— | |||
| 3108 | WinRAR.exe | C:\Users\admin\Desktop\Windows KMS Activator Ultimate 2019 4.5 Setup.exe | executable | |
MD5:— | SHA256:— | |||
| 2908 | Windows KMS Activator Ultimate 2019 4.5 Setup.exe | C:\Users\admin\AppData\Local\Temp\is-J1QHS.tmp\Windows KMS Activator Ultimate 2019 4.5 Setup.tmp | executable | |
MD5:60B4F16A04FD2A1A337B5D480CB0B917 | SHA256:AF598EA185290350BE853856C0D09D586D6F34F25F642379C7C2E2A1D822DF5E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3844 | Windows KMS Activator Ultimate 2019 4.5.exe | GET | 200 | 104.219.248.105:80 | http://renewsoftware.com/1-winkms/KMSserverLIST.txt | US | text | 447 b | malicious |
3844 | Windows KMS Activator Ultimate 2019 4.5.exe | GET | 200 | 104.219.248.105:80 | http://renewsoftware.com/1-winkms/Version.txt | US | text | 7 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3844 | Windows KMS Activator Ultimate 2019 4.5.exe | 104.219.248.105:80 | renewsoftware.com | Namecheap, Inc. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
renewsoftware.com |
| malicious |