File name:

KMSAuto-Net.zip

Full analysis: https://app.any.run/tasks/68d4dfac-e3e3-4fe8-b4a7-d0750e9a5c6e
Verdict: Malicious activity
Analysis date: March 18, 2024, 17:14:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

386CB87E6430D914820D793DB19D7D33

SHA1:

160A3788D24787FBF1C7579AC2A5DA2D0AE8E25B

SHA256:

D4230CAE5C3E1B11FCA61A711E7F3886088F6728858108A6811670AA3616A57B

SSDEEP:

196608:qpAtZ+U7OeubvGx9Y9oFMmtcdV0wvnZDsuKYqCVtIlehIuoOCYgM2cXNAOQ8JWcC:qpesfvuw2FMmKwanBsuYLu8Yg/Pl8JWJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KMSAuto Net.exe (PID: 2560)
      • AESDecoder.exe (PID: 3592)
      • bin.dat (PID: 884)
      • bin_x86.dat (PID: 3860)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3936)
      • cmd.exe (PID: 3708)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 2560)
      • cmd.exe (PID: 3708)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3936)

    • Reads Internet Explorer settings

      • KMSAuto Net.exe (PID: 2560)

    • Executable content was dropped or overwritten

      • KMSAuto Net.exe (PID: 2560)
      • bin.dat (PID: 884)
      • AESDecoder.exe (PID: 3592)
      • bin_x86.dat (PID: 3860)

    • Drops 7-zip archiver for unpacking

      • KMSAuto Net.exe (PID: 2560)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2556)
      • cmd.exe (PID: 3568)

    • Process drops legitimate windows executable

      • bin_x86.dat (PID: 3860)

    • Drops a system driver (possible attempt to evade defenses)

      • bin_x86.dat (PID: 3860)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 2560)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 2560)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 2560)

    • Creates or modifies Windows services

      • KMSAuto Net.exe (PID: 2560)

    • Executes as Windows Service

      • KMSSS.exe (PID: 3704)

    • Uses REG/REGEDIT.EXE to modify registry

      • KMSAuto Net.exe (PID: 2560)
      • cmd.exe (PID: 952)

    • Reads the date of Windows installation

      • pwsh.exe (PID: 3676)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2208)

    • Reads the machine GUID from the registry

      • KMSAuto Net.exe (PID: 2560)
      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSSS.exe (PID: 3704)

    • Reads the computer name

      • KMSAuto Net.exe (PID: 2560)
      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSSS.exe (PID: 3704)
      • pwsh.exe (PID: 3676)
      • KMSAuto Net 1.5.1.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2208)

    • Manual execution by a user

      • KMSAuto Net 1.5.1.exe (PID: 2596)
      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 3404)
      • pwsh.exe (PID: 3676)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net.exe (PID: 1232)
      • KMSAuto Net.exe (PID: 2560)

    • Checks supported languages

      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • bin.dat (PID: 884)
      • AESDecoder.exe (PID: 3592)
      • bin_x86.dat (PID: 3860)
      • KMSSS.exe (PID: 3704)
      • pwsh.exe (PID: 3676)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net.exe (PID: 2560)

    • Creates files or folders in the user directory

      • KMSAuto Net.exe (PID: 2560)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 2560)

    • Reads product name

      • KMSAuto Net.exe (PID: 2560)

    • Creates files in the program directory

      • cmd.exe (PID: 2868)
      • KMSAuto Net.exe (PID: 2560)
      • bin.dat (PID: 884)
      • AESDecoder.exe (PID: 3592)
      • bin_x86.dat (PID: 3860)
      • KMSSS.exe (PID: 3704)

    • Reads Microsoft Office registry keys

      • KMSAuto Net.exe (PID: 2560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2017:10:11 22:06:02
ZipCRC: 0x5766da14
ZipCompressedSize: 11237126
ZipUncompressedSize: 11237230
ZipFileName: KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
49
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs bin.dat cmd.exe no specs cmd.exe no specs aesdecoder.exe cmd.exe no specs cmd.exe no specs bin_x86.dat cmd.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs pwsh.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs reg.exe no specs netsh.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
604C:\Windows\system32\cmd.exe /c netstat -ano | find ":1688 "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
840"sc.exe" stop KMSEmulatorC:\Windows\System32\sc.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
884bin.dat -y -pkmsautoC:\ProgramData\KMSAuto\bin.dat
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Console SFX
Exit code:
0
Version:
15.14
Modules
Images
c:\programdata\kmsauto\bin.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
952C:\Windows\System32\cmd.exe /D /c reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator /fC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
984cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1232"C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe" C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe—explorer.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
MEDIUM
Description:
KMSAuto Net
Exit code:
3221226540
Version:
1.4.9
Modules
Images
c:\users\admin\desktop\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net.exe
c:\windows\system32\ntdll.dll
1288C:\Windows\System32\cmd.exe /D /c AESDecoder.exeC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1308C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1336"C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe" C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe
explorer.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
HIGH
Description:
KMSAuto Net
Exit code:
0
Version:
1.5.1
Modules
Images
c:\users\admin\desktop\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net 1.5.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1728C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16 764
Read events
16 475
Write events
281
Delete events
8

Modification events

(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto-Net.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
17
Suspicious files
10
Text files
16
Unknown types
6

Dropped files

PID
Process
Filename
Type
3936WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zipcompressed
MD5:146C2759347E0D52625CCB4076E97EBB
SHA256:322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_en.txttext
MD5:2A710AB80A87F13F5AED664D04E5C6A6
SHA256:F9F41A1ADF235066F7B1C477CAE36A7AE9C344E7DEF7059A9148E74669809924
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_bg.txttext
MD5:D6761E218D57B85236345F74EA44A684
SHA256:E03107D2DEC7EB59033B4D0CACF9DD320C3BE1D9389295F87F069E667F138201
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_cn.txttext
MD5:67FA7B665E63269A86043ABA1C462EFA
SHA256:752D7FF42C648AFAC4D40A418512DB6E49896FA24BB1949442DDF50FF64B01AA
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_es.txttext
MD5:A99B01CEFE99E1DBCE3285F625320A43
SHA256:8B422282263EFC65C9F688F78632D8F931AC27E58FAFCBA49A7A9F1DCE012D1D
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exeexecutable
MD5:93A3A8CE440197D31168FAC569082937
SHA256:22EF521964080E77D7006F9341D720683FA98409361C62A7BC4FE81EC474B1B2
3936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3936.11990\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zipcompressed
MD5:146C2759347E0D52625CCB4076E97EBB
SHA256:322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36
2560KMSAuto Net.exeC:\ProgramData\KMSAuto\bin.datexecutable
MD5:2A96E417738225FA806A6EF275443BC8
SHA256:839D31305D8FA842C832E8EC0F61D6BC575734449EB774B7C8DD79669594E25B
2584cmd.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\test.testtext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
884bin.datC:\ProgramData\KMSAuto\bin\TunMirror.exe.aesbinary
MD5:6D6E295744D3750355227EFD55824BE1
SHA256:F67F0232100F7CC7E469DC14079EDF7D72EC25E48CA3B5AC9B40ED025F1BA0EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3676
pwsh.exe
23.34.234.76:443
aka.ms
Bezeq International
US
unknown
3676
pwsh.exe
52.239.160.36:443
pscoretestdata.blob.core.windows.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
aka.ms
  • 23.34.234.76
whitelisted
pscoretestdata.blob.core.windows.net
  • 52.239.160.36
unknown

Threats

No threats detected
Process
Message
pwsh.exe
Profiler was prevented from loading notification profiler due to app settings. Process ID (decimal): 3676. Message ID: [0x2509].
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto-Net.zip