File name:

Pre-Activated-Setup.exe

Full analysis: https://app.any.run/tasks/748659d8-a0bb-486b-ac47-e432f11122d5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 02, 2023, 19:41:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
lumma
stealer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

21B2D7C120B48ED18F67C899D13CEC78

SHA1:

055C4CDFC5EACC9ABD7E6CC0B5241FCB6BE4A6C6

SHA256:

1ABFE0C412984E8D10E3853635960319B96CA9A67F1FB61A60CB279D026BCF7C

SSDEEP:

98304:XhXS4dqnqQh0BP3UH0oF5wvqz83/OxPeoHX3oJ311Np99Eftfw1fSw6TBYDgwjLc:R1NCX86ealhRmNXa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • Pre-Activated-Setup.exe (PID: 3416)

    • LUMMA has been detected (SURICATA)

      • Pre-Activated-Setup.exe (PID: 3416)

    • Drops the executable file immediately after the start

      • Pre-Activated-Setup.exe (PID: 3416)
      • vpwjoiaqvo.exe (PID: 3576)

    • Starts CMD.EXE for self-deleting

      • Pre-Activated-Setup.exe (PID: 3416)

    • Actions looks like stealing of personal data

      • Pre-Activated-Setup.exe (PID: 3416)

    • Uses Task Scheduler to run other applications

      • YKM.exe (PID: 3640)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Pre-Activated-Setup.exe (PID: 3416)
      • vpwjoiaqvo.exe (PID: 3576)
      • YKM.exe (PID: 3640)

    • Reads browser cookies

      • Pre-Activated-Setup.exe (PID: 3416)

    • Process requests binary or script from the Internet

      • Pre-Activated-Setup.exe (PID: 3416)

    • Reads the BIOS version

      • vpwjoiaqvo.exe (PID: 3576)
      • YKM.exe (PID: 3640)
      • YKM.exe (PID: 4008)
      • YKM.exe (PID: 3892)
      • YKM.exe (PID: 4088)
      • YKM.exe (PID: 3736)

    • Executing commands from a ".bat" file

      • vpwjoiaqvo.exe (PID: 3576)

    • Starts CMD.EXE for commands execution

      • vpwjoiaqvo.exe (PID: 3576)
      • Pre-Activated-Setup.exe (PID: 3416)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3276)
      • cmd.exe (PID: 3556)

    • Searches for installed software

      • Pre-Activated-Setup.exe (PID: 3416)

    • The process executes via Task Scheduler

      • YKM.exe (PID: 3736)
      • YKM.exe (PID: 4008)
      • YKM.exe (PID: 4088)
      • YKM.exe (PID: 3892)

  • INFO

    • Reads the machine GUID from the registry

      • Pre-Activated-Setup.exe (PID: 3416)
      • wmpnscfg.exe (PID: 3496)

    • Checks supported languages

      • Pre-Activated-Setup.exe (PID: 3416)
      • wmpnscfg.exe (PID: 3496)
      • vpwjoiaqvo.exe (PID: 3576)
      • YKM.exe (PID: 3640)
      • YKM.exe (PID: 4008)
      • YKM.exe (PID: 3736)
      • YKM.exe (PID: 3892)
      • YKM.exe (PID: 4088)

    • Reads the computer name

      • Pre-Activated-Setup.exe (PID: 3416)
      • wmpnscfg.exe (PID: 3496)
      • vpwjoiaqvo.exe (PID: 3576)
      • YKM.exe (PID: 3640)

    • Checks proxy server information

      • Pre-Activated-Setup.exe (PID: 3416)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3496)

    • Create files in a temporary directory

      • Pre-Activated-Setup.exe (PID: 3416)
      • vpwjoiaqvo.exe (PID: 3576)

    • Creates files in the program directory

      • vpwjoiaqvo.exe (PID: 3576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:29 15:37:20+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 451584
InitializedDataSize: 452096
UninitializedDataSize: -
EntryPoint: 0x736192
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 23.3.9.1
ProductVersionNumber: 12.14.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Korean
CharacterSet: Unicode
CompanyName: ESTsoft Corp.
FileDescription: ALZip
FileVersion: 23.3.9.1
InternalName: auirender
LegalCopyright: Copyright (c) 1999 - present ESTsoft Corp. All right reserved.
OriginalFileName: main-mfc.exe
ProductName: ALZip
ProductVersion: 12.14.0.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
14
Malicious processes
2
Suspicious processes
6

Behavior graph

Click at the process to see the details
start #LUMMA pre-activated-setup.exe wmpnscfg.exe no specs vpwjoiaqvo.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs ykm.exe no specs fsutil.exe no specs schtasks.exe no specs ykm.exe no specs ykm.exe no specs ykm.exe no specs ykm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3276C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s2rc.0.bat" "C:\Windows\System32\cmd.exe—vpwjoiaqvo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3416"C:\Users\admin\AppData\Local\Temp\Pre-Activated-Setup.exe" C:\Users\admin\AppData\Local\Temp\Pre-Activated-Setup.exe
explorer.exe
User:
admin
Company:
ESTsoft Corp.
Integrity Level:
MEDIUM
Description:
ALZip
Exit code:
0
Version:
23.3.9.1
Modules
Images
c:\users\admin\appdata\local\temp\pre-activated-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3444timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
3496"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3556cmd.exe /c timeout /nobreak /t 3 & fsutil file setZeroData offset=0 length=6663327 "C:\Users\admin\AppData\Local\Temp\Pre-Activated-Setup.exe" & erase "C:\Users\admin\AppData\Local\Temp\Pre-Activated-Setup.exe" & exitC:\Windows\System32\cmd.exe—Pre-Activated-Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3576"C:\Users\admin\AppData\Local\Temp\vpwjoiaqvo.exe"C:\Users\admin\AppData\Local\Temp\vpwjoiaqvo.exe—Pre-Activated-Setup.exe
User:
admin
Company:
Schneider Electric
Integrity Level:
MEDIUM
Description:
PowerChute Application
Exit code:
0
Version:
3.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\vpwjoiaqvo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3640"C:\ProgramData\SMUCCI\YKM.exe" C:\ProgramData\SMUCCI\YKM.exe—cmd.exe
User:
admin
Company:
Schneider Electric
Integrity Level:
MEDIUM
Description:
PowerChute Application
Exit code:
0
Version:
3.0.2.0
Modules
Images
c:\programdata\smucci\ykm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3660timeout /nobreak /t 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
3736C:\ProgramData\SMUCCI\YKM.exe C:\ProgramData\SMUCCI\YKM.exe—taskeng.exe
User:
admin
Company:
Schneider Electric
Integrity Level:
MEDIUM
Description:
PowerChute Application
Exit code:
0
Version:
3.0.2.0
Modules
Images
c:\programdata\smucci\ykm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3852fsutil file setZeroData offset=0 length=6663327 "C:\Users\admin\AppData\Local\Temp\Pre-Activated-Setup.exe" C:\Windows\System32\fsutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
fsutil.exe
Exit code:
1
Version:
6.1.7601.17577 (win7sp1_gdr.110310-1504)
Modules
Images
c:\windows\system32\fsutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ktmw32.dll
c:\windows\system32\ole32.dll
Total events
1 555
Read events
1 532
Write events
20
Delete events
3

Modification events

(PID) Process:(3416) Pre-Activated-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3416) Pre-Activated-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3416) Pre-Activated-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3416) Pre-Activated-Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3496) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{245A41A9-A5A8-45EE-885B-E4B842384872}\{65262667-6D5E-4C10-88FD-42E9AFF6BB34}
Operation:delete keyName:(default)
Value:
(PID) Process:(3496) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{245A41A9-A5A8-45EE-885B-E4B842384872}
Operation:delete keyName:(default)
Value:
(PID) Process:(3496) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{D5A4089A-263F-474E-97B5-7CEB90A5F883}
Operation:delete keyName:(default)
Value:
(PID) Process:(3576) vpwjoiaqvo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3576) vpwjoiaqvo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3576) vpwjoiaqvo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3576vpwjoiaqvo.exeC:\Users\admin\AppData\Local\Temp\s2rc.0.battext
MD5:D693960C0E8BC1A1A0662CC64B8FB4F9
SHA256:85AE3E607614C1C31428B78888C98430CF03014357C8CC0C6C7A73AF57EFF361
3416Pre-Activated-Setup.exeC:\Users\admin\AppData\Local\Temp\vpwjoiaqvo.exeexecutable
MD5:1A2451581BC6634394523C4282F33A77
SHA256:DF3DAFCB0C1953ED6A75E2FBDE8D82F110CBFC39D5C9267DA3BAA80FEF1DE12B
3576vpwjoiaqvo.exeC:\ProgramData\SMUCCI\YKM.exeexecutable
MD5:1A2451581BC6634394523C4282F33A77
SHA256:DF3DAFCB0C1953ED6A75E2FBDE8D82F110CBFC39D5C9267DA3BAA80FEF1DE12B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
35
DNS requests
2
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
8.29 Kb
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
3416
Pre-Activated-Setup.exe
POST
200
188.114.97.9:80
http://booudbras.pw/api
unknown
text
2 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3416
Pre-Activated-Setup.exe
188.114.97.9:80
booudbras.pw
CLOUDFLARENET
NL
unknown
3416
Pre-Activated-Setup.exe
162.215.241.165:80
accommod8blr.com
UNIFIEDLAYER-AS-1
US
unknown

DNS requests

Domain
IP
Reputation
booudbras.pw
  • 188.114.97.9
  • 188.114.96.9
unknown
accommod8blr.com
  • 162.215.241.165
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
3416
Pre-Activated-Setup.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3416
Pre-Activated-Setup.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In
3416
Pre-Activated-Setup.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3416
Pre-Activated-Setup.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
3416
Pre-Activated-Setup.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
3416
Pre-Activated-Setup.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
3416
Pre-Activated-Setup.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3416
Pre-Activated-Setup.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3416
Pre-Activated-Setup.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Pre-Activated-Setup.exe