Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\kmsauto
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator] 'ImagePath' = 'temp.exe'
- [HKLM\SYSTEM\CurrentControlSet\services\KMSEmulator] 'ImagePath' = '"%WINDIR%\Temp\KMSAuto\bin\KMSSS.exe" -Port 1688 -PWin 05426-00206-152-021610-03-1033-9200.0000-1132013 -PO14 05426-00096-185...
- [HKLM\SYSTEM\CurrentControlSet\Services\WinDivert1.1] 'ImagePath' = '%WINDIR%\Temp\KMSAuto\bin\driver\x64WDV\WinDivert.sys'
Creates the following services
- 'KMSEmulator' temp.exe
- 'WinDivert1.1' %WINDIR%\Temp\KMSAuto\bin\driver\x64WDV\WinDivert.sys
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
Modifies file system
Creates the following files
- %WINDIR%\activator.exe
- %APPDATA%\microsoft\windows\start menu\programs\активация ms office.lnk
- %TEMP%\rarsfx0\kmsauto.exe
- %TEMP%\rarsfx0\kmsautolite.ini
- %TEMP%\rarsfx0\readme_ru.txt
- %TEMP%\rarsfx0\activator.exe
- %TEMP%\fb53.tmp\activator.cmd
- %WINDIR%\kmsauto.xml
- %WINDIR%\kmsauto.exe
- %WINDIR%\kmsautolite.ini
- %TEMP%\kmsauto.tmp
- %WINDIR%\temp\kmsauto\bin.dat
- %WINDIR%\temp\kmsauto\bin\kmsss.exe.aes
- %WINDIR%\temp\kmsauto\bin\aesdecoder.exe
- %WINDIR%\temp\kmsauto\bin\kmsss.exe
- %WINDIR%\temp\kmsauto\bin\kmsactivator.vbs
- %WINDIR%\temp\kmsauto\bin_x64.dat
- %WINDIR%\temp\kmsauto\bin\driver\x64wdv\windivert.inf
- %WINDIR%\temp\kmsauto\bin\driver\x64wdv\wdfcoinstaller01009.dll
- %WINDIR%\temp\kmsauto\bin\driver\x64wdv\windivert.dll
- %WINDIR%\temp\kmsauto\bin\driver\x64wdv\windivert.sys
- %WINDIR%\temp\kmsauto\bin\driver\x64wdv\fakeclient.exe
- %TEMP%\content\4908-5028-cscript.exe-13-18-20-813.dump
- %TEMP%\content\4908-5028-cscript.exe-13-18-22-049.dump
- %TEMP%\content\4908-5028-cscript.exe-13-18-22-060.dump
Deletes following files that it created itself
- %WINDIR%\kmsauto.xml
- %TEMP%\kmsauto.tmp
- %WINDIR%\temp\kmsauto\bin.dat
- %WINDIR%\temp\kmsauto\bin\kmsss.exe.aes
- %WINDIR%\temp\kmsauto\bin\aesdecoder.exe
- %WINDIR%\temp\kmsauto\bin_x64.dat
Network activity
TCP
Other
- '14#.#11.45.87':49696
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\activator.exe' /ofs=act /sched=ofs
- '%TEMP%\rarsfx0\activator.exe'
- '%TEMP%\rarsfx0\kmsauto.exe' /ofs=act /sched=ofs
- '%WINDIR%\temp\kmsauto\bin.dat' -y -pkmsauto
- '%WINDIR%\temp\kmsauto\bin\aesdecoder.exe'
- '%WINDIR%\temp\kmsauto\bin\kmsss.exe' -Port 1688 -PWin 05426-00206-152-021610-03-1033-9200.0000-1132013 -PO14 05426-00096-185-611894-03-1031-9200.0000-1862013 -PO15 55041-00206-234-996296-03-1274-7601.0000-2582012 -AI 43200 -RI 432...
- '%WINDIR%\temp\kmsauto\bin_x64.dat' -y -pkmsauto
- '%WINDIR%\temp\kmsauto\bin\driver\x64wdv\fakeclient.exe' 14#.#11.45.87
- '<SYSTEM32>\cscript.exe' %WINDIR%\Temp\KMSAuto\bin\KMSactivator.vbs //NoLogo /ADR:14#.#11.45.87 /PRT:1688 /PWN:1688 /P10:1688 /P13:1688 /ACT:OFS
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FB53.tmp\Activator.cmd" "
- '<SYSTEM32>\cmd.exe' /c copy <SYSTEM32>\Tasks\KMSAuto "%TEMP%\KMSAuto.tmp" /Y
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /end /TN KMSAuto
- '<SYSTEM32>\schtasks.exe' /end /TN KMSAuto
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /delete /TN KMSAuto /F
- '<SYSTEM32>\schtasks.exe' /delete /TN KMSAuto /F
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /TN KMSAuto /XML %WINDIR%\KMSAuto.xml
- '<SYSTEM32>\schtasks.exe' /create /TN KMSAuto /XML %WINDIR%\KMSAuto.xml
- '<SYSTEM32>\cmd.exe' /c bin.dat -y -pkmsauto
- '<SYSTEM32>\cmd.exe' /c AESDecoder.exe
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
- '<SYSTEM32>\netsh.exe' Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
- '<SYSTEM32>\cmd.exe' /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
- '<SYSTEM32>\sc.exe' create KMSEmulator binpath= temp.exe type= own start= auto
- '<SYSTEM32>\cmd.exe' /c sc.exe start KMSEmulator
- '<SYSTEM32>\sc.exe' start KMSEmulator
- '<SYSTEM32>\cmd.exe' /c bin_x64.dat -y -pkmsauto
- '<SYSTEM32>\cmd.exe' /c route.exe -p add 14#.#11.45.87 0.0.0.0 IF 1
- '<SYSTEM32>\route.exe' -p add 14#.#11.45.87 0.0.0.0 IF 1
- '<SYSTEM32>\cmd.exe' /c cscript.exe %WINDIR%\Temp\KMSAuto\bin\KMSactivator.vbs //NoLogo /ADR:14#.#11.45.87 /PRT:1688 /PWN:1688 /P10:1688 /P13:1688 /ACT:OFS
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FB53.tmp\Activator.cmd" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy <SYSTEM32>\Tasks\KMSAuto "%TEMP%\KMSAuto.tmp" /Y' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /end /TN KMSAuto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /delete /TN KMSAuto /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /TN KMSAuto /XML %WINDIR%\KMSAuto.xml' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bin.dat -y -pkmsauto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c AESDecoder.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc.exe start KMSEmulator' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bin_x64.dat -y -pkmsauto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c route.exe -p add 14#.#11.45.87 0.0.0.0 IF 1' (with hidden window)
- '%WINDIR%\temp\kmsauto\bin\driver\x64wdv\fakeclient.exe' 14#.#11.45.87' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cscript.exe %WINDIR%\Temp\KMSAuto\bin\KMSactivator.vbs //NoLogo /ADR:14#.#11.45.87 /PRT:1688 /PWN:1688 /P10:1688 /P13:1688 /ACT:OFS' (with hidden window)
