File name:

KMSpico Portable.rar

Full analysis: https://app.any.run/tasks/da586386-5781-4ef4-ba91-44fa316bb260
Verdict: Malicious activity
Analysis date: July 17, 2019, 08:23:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: RecoveryRecordPresent
MD5:

1FB817F415810E4439A1BB13EA7A8F7F

SHA1:

9E764B48535BC5AE31DDCD238DC8E2FED60EB331

SHA256:

F49247279A2C1E6D9B39009700BFCE2925736064293F9B0D4E7463ECFB0819B1

SSDEEP:

98304:oUPBGvnmW9dn1qJ+7kl2D+0NUbtZ09lSZTYg:oUPNW3n1Nk6tNtDSWg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AutoPico.exe (PID: 3512)
      • AutoPico.exe (PID: 576)

  • SUSPICIOUS

    • Creates or modifies windows services

      • AutoPico.exe (PID: 3512)

    • Reads Environment values

      • AutoPico.exe (PID: 3512)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3904)

  • INFO

    • Reads Microsoft Office registry keys

      • AutoPico.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 261664
UncompressedSize: 745664
OperatingSystem: Win32
ModifyDate: 2016:02:21 07:22:29
PackingMethod: Normal
ArchivedFileName: KMSpico Portable\AutoPico.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe autopico.exe no specs autopico.exe

Process information

PID
CMD
Path
Indicators
Parent process
576"C:\Users\admin\AppData\Local\Temp\Rar$EXa3904.34086\KMSpico Portable\AutoPico.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3904.34086\KMSpico Portable\AutoPico.exe—WinRAR.exe
User:
admin
Company:
@ByELDI
Integrity Level:
MEDIUM
Description:
AutoPico
Exit code:
3221226540
Version:
16.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3904.34086\kmspico portable\autopico.exe
c:\systemroot\system32\ntdll.dll
3512"C:\Users\admin\AppData\Local\Temp\Rar$EXa3904.34086\KMSpico Portable\AutoPico.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3904.34086\KMSpico Portable\AutoPico.exe
WinRAR.exe
User:
admin
Company:
@ByELDI
Integrity Level:
HIGH
Description:
AutoPico
Exit code:
3221225547
Version:
16.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3904.34086\kmspico portable\autopico.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3904"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\KMSpico Portable.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
625
Read events
574
Write events
51
Delete events
0

Modification events

(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3904) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSpico Portable.rar
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3904) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3904) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:@C:\Windows\regedit.exe,-309
Value:
Registration Entries
(PID) Process:(3904) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6003
Value:
Windows Command Script
Executable files
10
Suspicious files
0
Text files
706
Unknown types
26

Dropped files

PID
Process
Filename
Type
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Access\AccessVLReg64.regtext
MD5:3C688EC4EDC18A1FFA7EA020556504DB
SHA256:EE5C8D9592F48DEED26590C06756CC7EABF96ED0BEA56B8DD87EC6C80871B9B9
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-msxml
MD5:B9B7F8BBE224421D24F0883A5149B9DC
SHA256:55CE78CAA24FBC6ECE43F336D73372AD47BB6C1748D7B72513BEB77CB355E8F5
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Access\AccessVLRegWOW.regtext
MD5:50122EA723FFE7367AD811FC333594C2
SHA256:18B8099777C8956C4299DA79A44BF9CB3ADDE96B652A0C6D063BF6C9A925B0B8
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Access\AccessVLReg32.regtext
MD5:19506B075C7448CE328682DA3D1A57B0
SHA256:0BB62DF2FDAB1A42A2303729400C343D70090C1F18123357456922C7544131B8
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Excel\ExcelVLReg64.regtext
MD5:E7102112F58F9A4FE2E6C28AE9F29343
SHA256:2080AEC1D6D2DC9F4BBF825560981F00181F1918426DD8129F99F0EF4CADFADD
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-msxml
MD5:14D12F9F6107BBF0C0314FE02FF5DC27
SHA256:C66AA472011A02DAD09971C29320E55F6B46DF9DCCCE4D9F01EC6D147D9BC99F
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Excel\ExcelVLRegWOW.regtext
MD5:D176B75D51FD47CD9C933F84FF55907A
SHA256:03CAF6C2A36E70C0DFBF53BCCD1956D2823965FC01DF4629308887DD1F0F8AFB
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-msxml
MD5:172B4FDA35D922C837A254AC561DE21E
SHA256:39825A0E6C6EBDFEB7F6F038568DB4516AB17DC4FF1C4A56AA28FE9A2859D270
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\AutoPico.exeexecutable
MD5:CFE1C391464C446099A5EB33276F6D57
SHA256:4A714D98CE40F5F3577C306A66CB4A6B1FF3FD01047C7F4581F8558F0BCDF5FA
3904WinRAR.exeC:\Users\admin\AppData\Local\Temp\KMSpico Portable\KMSpico Portable\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-msxml
MD5:A279AB8F8C617DF9C5411FDC199E7676
SHA256:9084E7F35F7220EC760719B29721A267943178972578E739BDAC2D6475A573E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3512
AutoPico.exe
131.234.137.63:123
1.pool.ntp.org
Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.
DE
unknown

DNS requests

Domain
IP
Reputation
1.pool.ntp.org
  • 80.153.195.191
  • 129.70.132.34
  • 94.130.231.116
  • 131.234.137.63
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSpico Portable.rar