File name:

#!!SetUp_2244_PassW0rd$.zip

Full analysis: https://app.any.run/tasks/e7387d01-189d-4f28-a7ad-363202f95dcc
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 29, 2024, 21:11:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

393C305049A3AFC418E588C595675A04

SHA1:

ACF87E4BADE45AF007274E25723440C351B4E632

SHA256:

AB9898C7C1C76610AB6083070909DF728FF102A708BF1A919D49E8A970CF9BB7

SSDEEP:

98304:dIwuK3u3PQGiEdjHKtJo+UDvaaSXvw5Z5Uzj7IYl3zVB9lBdmZ7lv+OMEu40uPHw:ptS/6nfyR5dh1fNeEjl9CT73pTt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3392)
      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 6592)
      • tasklist.exe (PID: 6396)
      • find.exe (PID: 3704)
      • tasklist.exe (PID: 2824)
      • cmd.exe (PID: 812)
      • find.exe (PID: 4192)
      • cmd.exe (PID: 1720)
      • tasklist.exe (PID: 4288)
      • cmd.exe (PID: 7052)
      • tasklist.exe (PID: 7112)
      • find.exe (PID: 6592)
      • cmd.exe (PID: 4104)
      • tasklist.exe (PID: 4316)
      • find.exe (PID: 996)
      • find.exe (PID: 6324)
      • avengine.exe (PID: 6056)
      • avp.exe (PID: 2996)
      • f-prot.exe (PID: 6064)
      • avgemc.exe (PID: 4436)
      • navapsvc.exe (PID: 7096)
      • ashServ.exe (PID: 4092)
      • mcshield.exe (PID: 5828)
      • cmd.exe (PID: 6232)
      • tasklist.exe (PID: 7732)
      • find.exe (PID: 7676)
      • cmd.exe (PID: 7784)
      • find.exe (PID: 7600)
      • tasklist.exe (PID: 7576)
      • find.exe (PID: 3140)
      • tasklist.exe (PID: 7860)
      • cmd.exe (PID: 3804)
      • tasklist.exe (PID: 7832)
      • cmd.exe (PID: 7488)
      • find.exe (PID: 1080)
      • cmd.exe (PID: 7508)
      • tasklist.exe (PID: 7132)
      • find.exe (PID: 7064)

    • Connects to the CnC server

      • svchost.exe (PID: 2284)

    • LUMMA has been detected (SURICATA)

      • explorer.exe (PID: 7224)
      • svchost.exe (PID: 2284)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 7224)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1912)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • Setup.tmp (PID: 4236)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Derby Loader.exe (PID: 396)
      • Setup.tmp (PID: 7360)
      • Setup.exe (PID: 7328)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)
      • ScreenSketch.exe (PID: 1884)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Creates file in the systems drive root

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 7360)

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • The process drops C-runtime libraries

      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • Setup.tmp (PID: 4236)

    • Runs PING.EXE to delay simulation

      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 4236)

    • Starts CMD.EXE for commands execution

      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 4236)

    • Get information on the list of running processes

      • Setup.tmp (PID: 4476)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 188)
      • cmd.exe (PID: 1720)
      • cmd.exe (PID: 812)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 4104)
      • Setup.tmp (PID: 4236)
      • cmd.exe (PID: 6232)
      • cmd.exe (PID: 7264)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 7488)
      • cmd.exe (PID: 7508)

    • Starts itself from another location

      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 7608)

    • Starts application with an unusual extension

      • ImPackr.exe (PID: 4940)
      • ImPackr.exe (PID: 1148)

    • The process creates files with name similar to system file names

      • Derby Loader.exe (PID: 396)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 7224)
      • svchost.exe (PID: 2284)

  • INFO

    • Checks proxy server information

      • slui.exe (PID: 2708)

    • Reads the software policy settings

      • slui.exe (PID: 2708)
      • explorer.exe (PID: 7224)

    • Manual execution by a user

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)
      • Setup.exe (PID: 6352)
      • Taskmgr.exe (PID: 6124)
      • Taskmgr.exe (PID: 1596)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • mspaint.exe (PID: 7760)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)

    • Create files in a temporary directory

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 4940)
      • more.com (PID: 3228)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)
      • ImPackr.exe (PID: 1148)
      • more.com (PID: 7728)

    • Checks supported languages

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.exe (PID: 7164)
      • ImPackr.exe (PID: 7096)
      • StrCmp.exe (PID: 5304)
      • more.com (PID: 3228)
      • ImPackr.exe (PID: 4940)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)
      • ImPackr.exe (PID: 1148)
      • StrCmp.exe (PID: 7664)
      • more.com (PID: 7728)
      • ScreenSketch.exe (PID: 1884)
      • ImPackr.exe (PID: 7608)

    • Reads Environment values

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)

    • Reads the computer name

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • more.com (PID: 3228)
      • StrCmp.exe (PID: 5304)
      • Derby Loader.exe (PID: 396)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)
      • ImPackr.exe (PID: 7608)
      • ImPackr.exe (PID: 1148)
      • StrCmp.exe (PID: 7664)
      • more.com (PID: 7728)
      • ScreenSketch.exe (PID: 1884)

    • Process checks computer location settings

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Setup.tmp (PID: 4236)
      • ScreenSketch.exe (PID: 1884)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6124)

    • Reads the machine GUID from the registry

      • Derby Loader.exe (PID: 396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:29 23:10:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: #!!SetUp_2244_PassW0rd$/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
363
Monitored processes
217
Malicious processes
15
Suspicious processes
11

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe slui.exe slui.exe no specs winrar.exe setup.exe setup.tmp setup.exe setup.tmp ping.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs impackr.exe impackr.exe strcmp.exe no specs more.com no specs conhost.exe no specs taskmgr.exe no specs taskmgr.exe derby loader.exe ollydbg.exe no specs conhost.exe no specs pexplorer.exe no specs idag.exe no specs procanalyzer.exe no specs idag64.exe no specs processhacker.exe no specs idaq.exe no specs idaq64.exe no specs immunitydebugger.exe no specs tcpdump.exe no specs tcpview.exe no specs regshot.exe no specs conhost.exe no specs dumpcap.exe no specs windbg.exe no specs conhost.exe no specs wireshark.exe no specs conhost.exe no specs fiddler.exe no specs conhost.exe no specs x64dbg.exe no specs conhost.exe no specs x32dbg.exe no specs conhost.exe no specs bdoesrv.exe no specs conhost.exe no specs kavpf.exe no specs mantispm.exe no specs conhost.exe no specs avengine.exe no specs conhost.exe no specs fspex.exe no specs conhost.exe no specs mcshld9x.exe no specs conhost.exe no specs mgavrtcl.exe no specs avguard.exe no specs savservice.exe no specs coreserviceshell.exe no specs conhost.exe no specs avgrsx.exe no specs avgwdsvc.exe no specs avgtray.exe no specs avpgui.exe no specs kavfs.exe no specs kavfsrcn.exe no specs kavtray.exe no specs 360rp.exe no specs conhost.exe no specs pccntmon.exe no specs avp.exe no specs conhost.exe no specs mcshield.exe no specs conhost.exe no specs ashserv.exe no specs conhost.exe no specs avgemc.exe no specs conhost.exe no specs navapsvc.exe no specs conhost.exe no specs avgagent.exe no specs conhost.exe no specs f-agnt95.exe no specs conhost.exe no specs f-prot.exe no specs conhost.exe no specs kav.exe no specs conhost.exe no specs nod32krn.exe no specs conhost.exe no specs ccsvchst.exe no specs conhost.exe no specs semsvc.exe no specs conhost.exe no specs mctray.exe no specs masvc.exe no specs conhost.exe no specs bdagent.exe no specs avgcsrvx.exe no specs fssm32.exe no specs conhost.exe no specs avastsvc.exe no specs conhost.exe no specs vsserv.exe no specs sysinspector.exe no specs conhost.exe no specs ekrn.exe no specs conhost.exe no specs ossec-agent.exe no specs conhost.exe no specs osqueryd.exe no specs vmsrvc.exe no specs vmusrvc.exe no specs prl_cc.exe no specs prl_tools.exe no specs conhost.exe no specs xenservice.exe no specs conhost.exe no specs qemu-ga.exe no specs sbiectrl.exe no specs joeboxserver.exe no specs joeboxcontrol.exe no specs conhost.exe no specs sandboxierpcss.exe no specs conhost.exe no specs autoruns.exe no specs conhost.exe no specs autorunsc.exe no specs conhost.exe no specs filemon.exe no specs conhost.exe no specs procmon.exe no specs conhost.exe no specs regmon.exe no specs conhost.exe no specs procexp.exe no specs conhost.exe no specs procexp64.exe no specs conhost.exe no specs procmon64.exe no specs vboxservice.exe no specs conhost.exe no specs vboxtray.exe no specs conhost.exe no specs vmtoolsd.exe no specs conhost.exe no specs vmwareuser.exe no specs conhost.exe no specs vgauthservice.exe no specs conhost.exe no specs vmacthlp.exe no specs conhost.exe no specs vm3dservice.exe no specs conhost.exe no specs setup.exe setup.tmp setup.exe setup.tmp ping.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs impackr.exe no specs impackr.exe no specs strcmp.exe no specs #LUMMA explorer.exe more.com no specs conhost.exe no specs mspaint.exe no specs screensketch.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"C:\Windows\System32\cmd.exe—Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
204"C:\Users\admin\Desktop/bin/joeboxcontrol.exe"C:\Users\admin\Desktop\bin\joeboxcontrol.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\joeboxcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
208"C:\Users\admin\Desktop/bin/nod32krn.exe"C:\Users\admin\Desktop\bin\nod32krn.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\nod32krn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
396"C:\Users\admin\Desktop\Derby Loader.exe" C:\Users\admin\Desktop\Derby Loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Derby Loader
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\derby loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
504\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—joeboxcontrol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
524"C:\Users\admin\Desktop/bin/coreServiceShell.exe"C:\Users\admin\Desktop\bin\coreServiceShell.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\coreserviceshell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
788"C:\Users\admin\Desktop/bin/prl_tools.exe"C:\Users\admin\Desktop\bin\prl_tools.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\prl_tools.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
812"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"C:\Windows\System32\cmd.exe—Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
920"C:\Users\admin\Desktop/bin/prl_cc.exe"C:\Users\admin\Desktop\bin\prl_cc.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\prl_cc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
996find /I "sophoshealth.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
35 238
Read events
35 080
Write events
136
Delete events
22

Modification events

(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000004204090000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F000000000000000000000000000000000000000000028020E000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000DE0210000000000000000000180000006400000000000000000000000000000003000000
Executable files
199
Suspicious files
13
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$.rar —
MD5:—
SHA256:—
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\PassCode.txt —
MD5:—
SHA256:—
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\Setup.exeexecutable
MD5:1CC167273EEAF450ABB5E548EDFABC89
SHA256:B16B380F60786A78E3E8760F4A65E0906F744E43B2A04EEAD206596727443082
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\Key.pngimage
MD5:322CFA2F21842153ACDEDCC58DE91389
SHA256:941A0B3C595E841BCC19D272FA1BB7A86E7EE348B37EF5E2177AC7286EF601E9
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-profile-l1-1-0.dllexecutable
MD5:6EE66DCA31C5CCE57740D677C85B4CE7
SHA256:D00A0EDACE14715BF79DBD17B715D8A74A2300F0ADB1F3FC137EDFB7074C9B0A
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-synch-l1-2-0.dllexecutable
MD5:659E4FEBC208545A2E23C0C8B881A30D
SHA256:9AC63682E03D55A5D18405D336634AF080DD0003B565D12A39D6D71AAA989F48
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-processthreads-l1-1-1.dllexecutable
MD5:29001F316CCFC800E2246743DF9B15B3
SHA256:E5EA2C21FB225090F7D0DB6C6990D67B1558D8E834E86513BC8BA7A43C4E7B36
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-crt-conio-l1-1-0.dllexecutable
MD5:7190CBFAD2D7773D3B88CCC25533A651
SHA256:4AEEAE0AC9F6C1B0B8835067EA3B7FC429F353565F18DE7858F4EA5D6F72072E
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-rtlsupport-l1-1-0.dllexecutable
MD5:0069FD29263C0DD90314C48BBCE852EF
SHA256:D11093FDC1D5C9213B9B2886CE91DB3DED17EF8DAE1615A8C7FFBC55B8E3F79B
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\PassCode.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
45
DNS requests
26
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
504
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
92.123.104.52:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2432
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2708
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.52
  • 92.123.104.47
  • 92.123.104.32
  • 92.123.104.46
  • 92.123.104.28
  • 92.123.104.33
  • 92.123.104.26
  • 92.123.104.31
  • 92.123.104.30
  • 92.123.104.59
  • 92.123.104.67
  • 92.123.104.18
  • 92.123.104.53
  • 92.123.104.65
  • 92.123.104.61
  • 92.123.104.10
whitelisted
google.com
  • 142.250.185.174
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 20.198.162.76
  • 40.115.3.253
whitelisted
th.bing.com
  • 92.123.104.30
  • 92.123.104.32
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.34
  • 92.123.104.47
  • 92.123.104.53
  • 92.123.104.33
  • 92.123.104.31
whitelisted

Threats

PID
Process
Class
Message
—
—
Domain Observed Used for C2 Detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (horizonvxjis .shop)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (horizonvxjis .shop)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
#!!SetUp_2244_PassW0rd$.zip