File name:

Windows KMS Activator By AR_Alex 3.3.sanet.st.zip

Full analysis: https://app.any.run/tasks/ea180cd0-4033-4f67-8959-38df15682d12
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 31, 2018, 08:28:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

CDF3271616F9D43D43E8F1072BEFF1BE

SHA1:

246FDCF02BCCBCEB9E88629EDD7967B48748C97B

SHA256:

C53CA75395708100B4A3F8272A193E20B926FED79DF48E99B7B6D70AA3383B0B

SSDEEP:

49152:PEvkZVMnhZSmFRd28KGfYirV1LM5jq1zFzViR3fJa9tS06nZu0FfU3QY5fRsmRsp:gOMPSY2fi7KAzFQNw9tuY0lvY5fb7E6y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2660)

    • Application was dropped or rewritten from another process

      • devcon.exe (PID: 3168)
      • devcon.exe (PID: 4080)
      • KMSServer.exe (PID: 3324)
      • TunMirror.exe (PID: 1716)

    • Uses BITADMIN.EXE for downloading application

      • cmd.exe (PID: 3280)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3832)
      • WinRAR.exe (PID: 1076)
      • WScript.exe (PID: 3180)
      • cmd.exe (PID: 3280)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1076)
      • devcon.exe (PID: 4080)
      • DrvInst.exe (PID: 2908)
      • DrvInst.exe (PID: 3468)

    • Executes scripts

      • cmd.exe (PID: 800)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 3280)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3112)
      • cmd.exe (PID: 3280)

    • Creates files in the Windows directory

      • devcon.exe (PID: 4080)
      • DrvInst.exe (PID: 2908)
      • DrvInst.exe (PID: 3468)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2908)
      • DrvInst.exe (PID: 3468)

    • Application launched itself

      • cmd.exe (PID: 3280)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2908)
      • DrvInst.exe (PID: 3468)

    • Creates or modifies windows services

      • DrvInst.exe (PID: 2908)
      • DrvInst.exe (PID: 3468)

    • Searches for installed software

      • DrvInst.exe (PID: 2908)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 3280)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3280)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3280)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2232)

    • Creates or modifies windows services

      • vssvc.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:10:31 09:53:03
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Windows KMS Activator By AR_Alex 3.3.sanet.st/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
92
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs mode.com no specs fltmc.exe no specs wscript.exe no specs cmd.exe mode.com no specs fltmc.exe no specs reg.exe no specs searchprotocolhost.exe no specs cmd.exe no specs mode.com no specs fltmc.exe no specs wscript.exe no specs cmd.exe mode.com no specs fltmc.exe no specs reg.exe no specs ping.exe no specs bitsadmin.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs find.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs findstr.exe no specs devcon.exe no specs devcon.exe drvinst.exe rundll32.exe no specs vssvc.exe no specs drvinst.exe no specs drvinst.exe cmd.exe no specs route.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs tunmirror.exe no specs netstat.exe no specs find.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs kmsserver.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cscript.exe no specs cscript.exe no specs sc.exe no specs cscript.exe no specs taskkill.exe no specs taskkill.exe no specs netsh.exe no specs cscript.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
256bitsadmin /Transfer myDownloadJob https://raw.githubusercontent.com/ARAlex143/activator/master/kmsactivator.txt C:\Users\admin\AppData\Local\Temp\kmsactivator.txt C:\Windows\system32\bitsadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
BITS administration utility
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\bitsadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
280fltmc C:\Windows\system32\fltMC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Filter Manager Control Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\fltmc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\fltlib.dll
328reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
360find "Enterprise" C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
360rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{1ceecebe-e95d-0b82-0aea-46377d0e793b} Global\{1e3dacbd-bcaa-39bf-bf9e-6a460281f812} C:\Windows\System32\DriverStore\Temp\{4101e2f9-da75-5fa9-a022-7509258fe725}\oemwin2k.inf C:\Windows\System32\DriverStore\Temp\{4101e2f9-da75-5fa9-a022-7509258fe725}\tap0901.catC:\Windows\system32\rundll32.exe—DrvInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\imm32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\rundll32.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
544find "Professional N" C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
564find "Professional E" C:\Windows\system32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
584mode con: cols=90 lines=29C:\Windows\system32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DOS Device MODE Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mode.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
800cmd /c ""C:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Windows KMS Activator By AR_Alex 3.3.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
884cscript.exe /nologo C:\Windows\System32\slmgr.vbs /upkC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
3 308
Read events
2 513
Write events
745
Delete events
50

Modification events

(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1076) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Windows KMS Activator By AR_Alex 3.3.sanet.st.zip
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1076) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\regedit.exe,-309
Value:
Registration Entries
(PID) Process:(1076) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6002
Value:
Windows Batch File
Executable files
23
Suspicious files
24
Text files
614
Unknown types
10

Dropped files

PID
Process
Filename
Type
1076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1076.20211\Windows KMS Activator By AR_Alex 3.3.battext
MD5:—
SHA256:—
3128cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\kmsactivator.txttext
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\KMSServer.exeexecutable
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\SECOService_x86.exeexecutable
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\SECOInjector_x64.exeexecutable
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\SECOInjector_x86.exeexecutable
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\SECOService_x64.exeexecutable
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\Settings.regtext
MD5:—
SHA256:—
1076WinRAR.exeC:\Users\admin\Desktop\Windows KMS Activator By AR_Alex 3.3.sanet.st\Kms_Files\Task_Files\1day_Office_Task.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
151.101.0.133:443
raw.githubusercontent.com
Fastly
US
malicious

DNS requests

Domain
IP
Reputation
www.google.de
  • 216.58.205.131
whitelisted
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows KMS Activator By AR_Alex 3.3.sanet.st.zip