File name:

Activator.exe

Full analysis: https://app.any.run/tasks/fa6084fa-a847-4880-b469-db654369abdd
Verdict: Malicious activity
Analysis date: July 12, 2018, 17:43:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

CD1F98BF03EAE5C3A86BBAC863AC50F3

SHA1:

EE7F39871486B04EB119C3290EC34DCF05EDED39

SHA256:

DE49D6E07C706BA0BE11D1C1D17DB2A274142A03B8AE4B50663912F880249324

SSDEEP:

49152:IT2YvV1B707vhpkYVp5oeT7x5KSpSx/fyoECHzhkaXQvlg77h7lJNlgh:C2YNH07HVp5oevxJM75zhvQNiFl1gh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • Activator.exe (PID: 3176)
      • sppsvc.exe (PID: 2136)
      • OSPPSVC.EXE (PID: 2020)

    • Application was dropped or rewritten from another process

      • KMS-R@1n.exe (PID: 2576)
      • KMS-R@1nHook.exe (PID: 1176)
      • KMS-R@1nHook.exe (PID: 1744)

    • Changes Image File Execution Options

      • Activator.exe (PID: 3176)

    • Loads dropped or rewritten executable

      • sppsvc.exe (PID: 2136)
      • OSPPSVC.EXE (PID: 2020)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • Activator.exe (PID: 3176)
      • sppsvc.exe (PID: 2136)

    • Starts SC.EXE for service management

      • Activator.exe (PID: 3176)

    • Uses NETSH.EXE for network configuration

      • Activator.exe (PID: 3176)

    • Creates or modifies windows services

      • Activator.exe (PID: 3176)

    • Executable content was dropped or overwritten

      • Activator.exe (PID: 3176)

    • Uses TASKKILL.EXE to kill process

      • Activator.exe (PID: 3176)

    • Removes files from Windows directory

      • sppsvc.exe (PID: 2136)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • sppsvc.exe (PID: 2136)
      • OSPPSVC.EXE (PID: 2020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

AssemblyVersion: 1.0.2.8
ProductVersion: 1.0.2.8
ProductName: R@1n Activator
OriginalFileName: Activator.exe
LegalTrademarks: -
LegalCopyright: Copyright © By R@1n 2017
InternalName: Activator.exe
FileVersion: 1.0.2.8
FileDescription: R@1n Activator
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.2.8
FileVersionNumber: 1.0.2.8
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3184b2
UninitializedDataSize: -
InitializedDataSize: 3274752
CodeSize: 3237376
LinkerVersion: 80
PEType: PE32
TimeStamp: 2017:07:16 15:36:23+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Jul-2017 13:36:23
Debug artifacts:
  • C:\Users\Paky89\Documents\Visual Studio 2015\Projects\R@1n10RC8GUI\R@1n\bin\Debug\CryptoObfuscator_Output\Activator.pdb
Comments: -
CompanyName: -
FileDescription: R@1n Activator
FileVersion: 1.0.2.8
InternalName: Activator.exe
LegalCopyright: Copyright © By R@1n 2017
LegalTrademarks: -
OriginalFilename: Activator.exe
ProductName: R@1n Activator
ProductVersion: 1.0.2.8
Assembly Version: 1.0.2.8

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 16-Jul-2017 13:36:23
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x003164B8
0x00316600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.87803
.reloc
0x0031A000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191
.rsrc
0x0031C000
0x00009080
0x00009200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.65265

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.98093
3674
UNKNOWN
UNKNOWN
RT_MANIFEST
2
4.20217
4264
UNKNOWN
UNKNOWN
RT_ICON
3
4.25374
9640
UNKNOWN
UNKNOWN
RT_ICON
4
3.96972
16936
UNKNOWN
UNKNOWN
RT_ICON
32512
2.62308
62
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
16
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start activator.exe taskkill.exe no specs taskkill.exe no specs sc.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs kms-r@1n.exe no specs sc.exe no specs kms-r@1nhook.exe no specs sppsvc.exe no specs kms-r@1nhook.exe no specs osppsvc.exe no specs activator.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
964"C:\Windows\System32\taskkill.exe" /f /im SppSvcC:\Windows\System32\taskkill.exe—Activator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1176KMS-R@1nHook.exe C:\Windows\system32\sppsvc.exeC:\Windows\KMS-R@1nHook.exe—services.exe
User:
NETWORK SERVICE
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\kms-r@1nhook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sppsvc.exe
1476"C:\Windows\System32\taskkill.exe" /f /im OsppSvcC:\Windows\System32\taskkill.exe—Activator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1744KMS-R@1nHook.exe "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Windows\KMS-R@1nHook.exe—services.exe
User:
NETWORK SERVICE
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\kms-r@1nhook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
1896"C:\Windows\System32\sc.exe" delete KMS-R@1nC:\Windows\System32\sc.exe—Activator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2020"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE—KMS-R@1nHook.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Software Protection Platform Service
Exit code:
0
Version:
14.0.0370.400 (longhorn(wmbla).090811-1833)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
2136C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe—KMS-R@1nHook.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Software Protection Platform Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sppsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2284"C:\Windows\System32\sc.exe" description "KMS-R@1n" "v0.2"C:\Windows\System32\sc.exe—Activator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2448"C:\Users\admin\Desktop\Activator.exe" C:\Users\admin\Desktop\Activator.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
R@1n Activator
Exit code:
3221226540
Version:
1.0.2.8
Modules
Images
c:\users\admin\desktop\activator.exe
c:\systemroot\system32\ntdll.dll
2576C:\Windows\KMS-R@1n.exeC:\Windows\KMS-R@1n.exe—services.exe
User:
NETWORK SERVICE
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\kms-r@1n.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\ws2_32.dll
Total events
291
Read events
222
Write events
67
Delete events
2

Modification events

(PID) Process:(3176) Activator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3176) Activator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Operation:delete valueName:VLActivationInterval
Value:
120
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Operation:delete valueName:VLRenewalInterval
Value:
10080
(PID) Process:(3040) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\93\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Operation:writeName:KeyManagementServiceName
Value:
127.0.0.2
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
Operation:writeName:KeyManagementServicePort
Value:
1686
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppSvc.exe
Operation:writeName:Debugger
Value:
KMS-R@1nHook.exe
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppSvc.exe
Operation:writeName:KMS_Emulation
Value:
0
(PID) Process:(3176) Activator.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppsvc
Operation:writeName:Start
Value:
2
Executable files
3
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2136sppsvc.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat.bak —
MD5:—
SHA256:—
2136sppsvc.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat —
MD5:—
SHA256:—
2136sppsvc.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.datbinary
MD5:—
SHA256:—
2020OSPPSVC.EXEC:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.datbinary
MD5:—
SHA256:—
3176Activator.exeC:\Windows\KMS-R@1nHook.exeexecutable
MD5:24B13D115DEB93F412C0C8A6A7BC4F9E
SHA256:480A49C7E8B1D08A8F98E149706F33163951DFDFE47CCDD703F24C99B22ECA56
3176Activator.exeC:\Windows\KMS-R@1n.exeexecutable
MD5:45CC0A256BED89A997725A6B264CC3EC
SHA256:9D0BB3B3BC50B3CE8FEDEBFA98D9E16D0540AABCA2AA6B00B3C3A442B3C2B84D
3176Activator.exeC:\Windows\KMS-R@1nHook.dllexecutable
MD5:120A5D9A69FD6B2133F87FB61A5BCC69
SHA256:E4651793B3C02E93A8D031DB4836C7F884E481F39D72BF831CA19B82D0D51340
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Activator.exe