File name:

Setup inc CRACK.zip

Full analysis: https://app.any.run/tasks/8bf4e374-d7ce-42a4-917a-7d6e73859065
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 11, 2019, 20:08:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
prepscram
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FBD640532CAE1E6CFDDF1980C7342C1C

SHA1:

CC3C37C7EB1B89DB9D39B03FD5064F75995976BA

SHA256:

0AACF8650F7AE9801C1DF492A39C2D5EF8C99CD00D20CB80468C1693F78227A4

SSDEEP:

196608:EuwxCHz/Z9PP3/jjS9G4JqWr87phLuGLEvRECK:VwIBhPbI3o7phLupvRhK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 3044)
      • setup.exe (PID: 3720)

    • PREPSCRAM was detected

      • setup.exe (PID: 3720)

    • Connects to CnC server

      • setup.exe (PID: 3720)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3272)

    • Application launched itself

      • setup.exe (PID: 3044)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:01:07 17:01:19
ZipCRC: 0xa67c96fb
ZipCompressedSize: 3531
ZipUncompressedSize: 14534
ZipFileName: CTAC.json
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start winrar.exe notepad.exe no specs setup.exe no specs #PREPSCRAM setup.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3044"C:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3272.25832\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
3224"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3272.24569\SERIAL.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3272"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Setup inc CRACK.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3720"C:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exe" "C:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exe
setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3272.25832\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
3956"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3272.28191\SERIAL.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
825
Read events
804
Write events
21
Delete events
0

Modification events

(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3272) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Setup inc CRACK.zip
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3272) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3224) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosX
Value:
44
(PID) Process:(3224) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosY
Value:
44
Executable files
4
Suspicious files
1
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\CTAC.jsontext
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3272.24569\SERIAL.txttext
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\SERIAL.txttext
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\dnssd.expexp
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\setup.exeexecutable
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\sedplugins.dllexecutable
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\WdfCoInstaller01011.dllexecutable
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3272.28191\SERIAL.txttext
MD5:—
SHA256:—
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\lang\cef_extensions.pakbinary
MD5:B7D530A9208AFA7D1C8B573BDD1C4D3A
SHA256:9C09BEB2C5EDC0B7A5E8B56C5F7D83A52DCCA5B6D005B08DAB2C460E7073EBFB
3272WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3272.25832\lang\libGLESv2.dllexecutable
MD5:3128349639AEC9A4A5C51B837DF8BA3C
SHA256:74A66FF1A1CADB2965C4167B214DFA1DAFA9A03BF01ABE64E1B49F633CFF8603
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3720
setup.exe
GET
200
143.204.208.2:80
http://d1hq9wbcfo7dcl.cloudfront.net/offer.php?affId=7332&trackingId=418997745&instId=7500&ho_trackingid=HO418997745&cc=US&sb=x86&wv=7sp1&db=InternetExplorer&uac=1&cid=5d979308c3b6ea5ad7e984e628c8cac1&v=3&net=4.7.03062&ie=8%2e0%2e7601%2e17514&res=1280x720&osd=644&kid=hqmrb21bc2p5l1o1iad
US
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3720
setup.exe
143.204.208.2:80
d1hq9wbcfo7dcl.cloudfront.net
—
US
malicious

DNS requests

Domain
IP
Reputation
d1hq9wbcfo7dcl.cloudfront.net
  • 143.204.208.2
  • 143.204.208.37
  • 143.204.208.50
  • 143.204.208.78
shared

Threats

PID
Process
Class
Message
3720
setup.exe
Unknown Traffic
ET INFO Suspicious User-Agent (1 space)
3720
setup.exe
Misc activity
ADWARE [PTsecurity] SoftwareBundler:Win32/Prepscram
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup inc CRACK.zip