File name:

KMSAuto-Net.zip

Full analysis: https://app.any.run/tasks/68d4dfac-e3e3-4fe8-b4a7-d0750e9a5c6e
Verdict: Malicious activity
Analysis date: March 18, 2024, 17:14:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

386CB87E6430D914820D793DB19D7D33

SHA1:

160A3788D24787FBF1C7579AC2A5DA2D0AE8E25B

SHA256:

D4230CAE5C3E1B11FCA61A711E7F3886088F6728858108A6811670AA3616A57B

SSDEEP:

196608:qpAtZ+U7OeubvGx9Y9oFMmtcdV0wvnZDsuKYqCVtIlehIuoOCYgM2cXNAOQ8JWcC:qpesfvuw2FMmKwanBsuYLu8Yg/Pl8JWJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KMSAuto Net.exe (PID: 2560)
      • AESDecoder.exe (PID: 3592)
      • bin.dat (PID: 884)
      • bin_x86.dat (PID: 3860)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 3936)
      • cmd.exe (PID: 3708)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3936)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 2560)
      • cmd.exe (PID: 3708)

    • Reads Internet Explorer settings

      • KMSAuto Net.exe (PID: 2560)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2556)
      • cmd.exe (PID: 3568)

    • Drops 7-zip archiver for unpacking

      • KMSAuto Net.exe (PID: 2560)

    • Executable content was dropped or overwritten

      • KMSAuto Net.exe (PID: 2560)
      • bin.dat (PID: 884)
      • AESDecoder.exe (PID: 3592)
      • bin_x86.dat (PID: 3860)

    • Drops a system driver (possible attempt to evade defenses)

      • bin_x86.dat (PID: 3860)

    • Process drops legitimate windows executable

      • bin_x86.dat (PID: 3860)

    • Executes as Windows Service

      • KMSSS.exe (PID: 3704)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 2560)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 2560)

    • Creates or modifies Windows services

      • KMSAuto Net.exe (PID: 2560)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 2560)

    • Reads the date of Windows installation

      • pwsh.exe (PID: 3676)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 952)
      • KMSAuto Net.exe (PID: 2560)

  • INFO

    • Checks supported languages

      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net.exe (PID: 2560)
      • AESDecoder.exe (PID: 3592)
      • bin_x86.dat (PID: 3860)
      • bin.dat (PID: 884)
      • KMSSS.exe (PID: 3704)
      • pwsh.exe (PID: 3676)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2208)

    • Reads the machine GUID from the registry

      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net.exe (PID: 2560)
      • KMSSS.exe (PID: 3704)

    • Reads the computer name

      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net.exe (PID: 2560)
      • KMSSS.exe (PID: 3704)
      • pwsh.exe (PID: 3676)

    • Manual execution by a user

      • KMSAuto Net 1.5.1.exe (PID: 2632)
      • KMSAuto Net 1.5.1.exe (PID: 3404)
      • KMSAuto Net 1.5.1.exe (PID: 1336)
      • KMSAuto Net 1.5.1.exe (PID: 2596)
      • KMSAuto Net.exe (PID: 1232)
      • KMSAuto Net.exe (PID: 2560)
      • pwsh.exe (PID: 3676)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2208)

    • Creates files or folders in the user directory

      • KMSAuto Net.exe (PID: 2560)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 2560)

    • Reads product name

      • KMSAuto Net.exe (PID: 2560)

    • Creates files in the program directory

      • cmd.exe (PID: 2868)
      • KMSAuto Net.exe (PID: 2560)
      • AESDecoder.exe (PID: 3592)
      • bin.dat (PID: 884)
      • bin_x86.dat (PID: 3860)
      • KMSSS.exe (PID: 3704)

    • Reads Microsoft Office registry keys

      • KMSAuto Net.exe (PID: 2560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2017:10:11 22:06:02
ZipCRC: 0x5766da14
ZipCompressedSize: 11237126
ZipUncompressedSize: 11237230
ZipFileName: KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
49
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net 1.5.1.exe no specs kmsauto net 1.5.1.exe kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs bin.dat cmd.exe no specs cmd.exe no specs aesdecoder.exe cmd.exe no specs cmd.exe no specs bin_x86.dat cmd.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs pwsh.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs reg.exe no specs netsh.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
604C:\Windows\system32\cmd.exe /c netstat -ano | find ":1688 "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
840"sc.exe" stop KMSEmulatorC:\Windows\System32\sc.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
884bin.dat -y -pkmsautoC:\ProgramData\KMSAuto\bin.dat
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Console SFX
Exit code:
0
Version:
15.14
Modules
Images
c:\programdata\kmsauto\bin.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
952C:\Windows\System32\cmd.exe /D /c reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator /fC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
984cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1232"C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe" C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net.exe—explorer.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
MEDIUM
Description:
KMSAuto Net
Exit code:
3221226540
Version:
1.4.9
Modules
Images
c:\users\admin\desktop\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net.exe
c:\windows\system32\ntdll.dll
1288C:\Windows\System32\cmd.exe /D /c AESDecoder.exeC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1308C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1336"C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe" C:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exe
explorer.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
HIGH
Description:
KMSAuto Net
Exit code:
0
Version:
1.5.1
Modules
Images
c:\users\admin\desktop\kmsauto net 2016 1.4.9 portable + 1.5.1\kmsauto net 1.5.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1728C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16 764
Read events
16 475
Write events
281
Delete events
8

Modification events

(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3936) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto-Net.zip
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3936) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
17
Suspicious files
10
Text files
16
Unknown types
6

Dropped files

PID
Process
Filename
Type
3936WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zipcompressed
MD5:146C2759347E0D52625CCB4076E97EBB
SHA256:322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_bg.txttext
MD5:D6761E218D57B85236345F74EA44A684
SHA256:E03107D2DEC7EB59033B4D0CACF9DD320C3BE1D9389295F87F069E667F138201
3936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3936.11990\KMSAuto Net 2016 1.4.9 Portable + 1.5.1.zipcompressed
MD5:146C2759347E0D52625CCB4076E97EBB
SHA256:322E6E04DB88AADBA5EF0C92CA471F2A11046C1884DDE3D3FA05C35F3418EF36
2584cmd.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\test.testtext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
2560KMSAuto Net.exeC:\ProgramData\KMSAuto\bin.datexecutable
MD5:2A96E417738225FA806A6EF275443BC8
SHA256:839D31305D8FA842C832E8EC0F61D6BC575734449EB774B7C8DD79669594E25B
884bin.datC:\ProgramData\KMSAuto\bin\AESDecoder.exeexecutable
MD5:B90ED3E4DBB23A464723706F12C86065
SHA256:8391D5B724D235BA52531D9A6D85E466382CE15CBD6BA97C4AD1278ED1F03BD7
884bin.datC:\ProgramData\KMSAuto\bin\TunMirror.exe.aesbinary
MD5:6D6E295744D3750355227EFD55824BE1
SHA256:F67F0232100F7CC7E469DC14079EDF7D72EC25E48CA3B5AC9B40ED025F1BA0EF
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_fr.txttext
MD5:474FB9BCC634EA9BC1F2B77382A0D03B
SHA256:D0B8BBE89016B3E05FF1C376C9A3CCE7CA2E4070BFFC11BFD9A91808B6DC060C
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\readme\readme_cn.txttext
MD5:67FA7B665E63269A86043ABA1C462EFA
SHA256:752D7FF42C648AFAC4D40A418512DB6E49896FA24BB1949442DDF50FF64B01AA
2208WinRAR.exeC:\Users\admin\Desktop\KMSAuto Net 2016 1.4.9 Portable + 1.5.1\KMSAuto Net 1.5.1.exeexecutable
MD5:93A3A8CE440197D31168FAC569082937
SHA256:22EF521964080E77D7006F9341D720683FA98409361C62A7BC4FE81EC474B1B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3676
pwsh.exe
23.34.234.76:443
aka.ms
Bezeq International
US
unknown
3676
pwsh.exe
52.239.160.36:443
pscoretestdata.blob.core.windows.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
aka.ms
  • 23.34.234.76
whitelisted
pscoretestdata.blob.core.windows.net
  • 52.239.160.36
unknown

Threats

No threats detected
Process
Message
pwsh.exe
Profiler was prevented from loading notification profiler due to app settings. Process ID (decimal): 3676. Message ID: [0x2509].
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto-Net.zip