download: | kmsauto-Downlading.zip |
Full analysis: | https://app.any.run/tasks/194c2b91-c68c-4904-88da-d91004954071 |
Verdict: | Malicious activity |
Analysis date: | February 22, 2020, 14:45:23 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | FB8E3ACDE54227E3571F5341FAFECF31 |
SHA1: | 74AF8EE3B4CEF71FC312D3D8D51AAC8F44BF3945 |
SHA256: | C814E977D6451EEEFACCE58C0E0FFD395BC8725853A40C67AA7A326D6B39CFE1 |
SSDEEP: | 98304:4RTZopVfzQTU0CsbGLsadxaXRgs5wJVz+sQ0sbaXY9+qtL8vH/cB83XoNZ2Gvm:QdqJAU0CsbGLwwg7M8LMfcS34rjO |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | - |
ZipCompression: | None |
ZipModifyDate: | 2015:10:22 11:10:04 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | - |
ZipUncompressedSize: | - |
ZipFileName: | KMSAuto Net 2015 v1.4.0 Portable/ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
916 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\kmsauto-Downlading.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
4008 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe | — | WinRAR.exe |
User: admin Company: MSFree Inc. Integrity Level: MEDIUM Description: KMSAuto Net Exit code: 3221226540 Version: 1.4.0 | ||||
3328 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe | WinRAR.exe | |
User: admin Company: MSFree Inc. Integrity Level: HIGH Description: KMSAuto Net Version: 1.4.0 | ||||
2072 | cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc" | C:\Windows\system32\cmd.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3460 | cmd /c echo test>>"C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\test.test" | C:\Windows\system32\cmd.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
956 | C:\Windows\System32\cmd.exe /D /c del /F /Q "test.test" | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2572 | "cscript.exe" /nologo C:\Windows\system32\slmgr.vbs /ipk FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4 | C:\Windows\system32\cscript.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2396 | C:\Windows\System32\cmd.exe /D /c md "C:\ProgramData\KMSAuto" | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3620 | C:\Windows\System32\cmd.exe /D /c bin.dat -y -pkmsauto | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3692 | bin.dat -y -pkmsauto | C:\ProgramData\KMSAuto\bin.dat | cmd.exe | |
User: admin Integrity Level: HIGH Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3460 | cmd.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\test.test | — | |
MD5:— | SHA256:— | |||
3328 | KMSAuto Net.exe | C:\ProgramData\KMSAuto\bin_x86.dat | — | |
MD5:— | SHA256:— | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_es.txt | text | |
MD5:564031DDACC56EDEC05E41786A798CF7 | SHA256:365AE7C998EEED200995322F2BFDAA68EEFC27F3DE81FF6DD8F855509457A74C | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_ua.txt | text | |
MD5:A57C260C2BD914D8D29FBBDEFCA1C0B1 | SHA256:59284FBDE0DF5173661AF8AC68D909454C3E85B1DCFBEB0E1035167DB0E95B49 | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_ru.txt | text | |
MD5:3130279E396F2673AB50F63DA65BA3EC | SHA256:F1F70751B549B4B44DDE66D62259279E0C669BEBA8E9961881C9379F98CD027F | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_en.txt | text | |
MD5:D4D51A055B4607ACAECB80CD76ABBEA2 | SHA256:010291FF9BDB9554F32FCDF90F2805961F0848163C0D0A47C11DDC032E45C80E | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_cn.txt | text | |
MD5:59160ED6FF5FC91D50369612DBB54499 | SHA256:6D4DDE9F36855408AFEFA302DBC5FBA49F1B1DA42CFDAED7EAF71949B1067ACB | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_bg.txt | text | |
MD5:BE93068E2139DFFB69831764D37101A4 | SHA256:B1993BBEB8471F544F8B0358918AE240EED4336DD0D98808297B6762F43CA7A8 | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_fr.txt | text | |
MD5:13A127FE54E0C32C685682898F3B9BF0 | SHA256:8D4B747DDB496DBCA93B513F8A850A2421F9699A91BE771D9C17797733BD8381 | |||
916 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa916.26149\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_vi.txt | text | |
MD5:02DA567E68D0AC19ACE3034FE521ABDA | SHA256:0C454CA1441D1C23A5D7F2EA2573DE9C580CC7768BAC457A5B2A2A9F4F461770 |