File name:

#!!SetUp_2244_PassW0rd$.zip

Full analysis: https://app.any.run/tasks/e7387d01-189d-4f28-a7ad-363202f95dcc
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 29, 2024, 21:11:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

393C305049A3AFC418E588C595675A04

SHA1:

ACF87E4BADE45AF007274E25723440C351B4E632

SHA256:

AB9898C7C1C76610AB6083070909DF728FF102A708BF1A919D49E8A970CF9BB7

SSDEEP:

98304:dIwuK3u3PQGiEdjHKtJo+UDvaaSXvw5Z5Uzj7IYl3zVB9lBdmZ7lv+OMEu40uPHw:ptS/6nfyR5dh1fNeEjl9CT73pTt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3392)
      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 5936)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 6592)
      • tasklist.exe (PID: 6396)
      • find.exe (PID: 3704)
      • cmd.exe (PID: 812)
      • tasklist.exe (PID: 2824)
      • find.exe (PID: 4192)
      • cmd.exe (PID: 1720)
      • tasklist.exe (PID: 4288)
      • tasklist.exe (PID: 4316)
      • find.exe (PID: 6592)
      • cmd.exe (PID: 4104)
      • find.exe (PID: 996)
      • find.exe (PID: 6324)
      • cmd.exe (PID: 7052)
      • tasklist.exe (PID: 7112)
      • avengine.exe (PID: 6056)
      • avp.exe (PID: 2996)
      • avgemc.exe (PID: 4436)
      • navapsvc.exe (PID: 7096)
      • ashServ.exe (PID: 4092)
      • mcshield.exe (PID: 5828)
      • f-prot.exe (PID: 6064)
      • cmd.exe (PID: 6232)
      • tasklist.exe (PID: 7732)
      • find.exe (PID: 7676)
      • tasklist.exe (PID: 7576)
      • cmd.exe (PID: 7784)
      • find.exe (PID: 7600)
      • tasklist.exe (PID: 7860)
      • cmd.exe (PID: 3804)
      • tasklist.exe (PID: 7832)
      • find.exe (PID: 3140)
      • cmd.exe (PID: 7488)
      • find.exe (PID: 1080)
      • cmd.exe (PID: 7508)
      • tasklist.exe (PID: 7132)
      • find.exe (PID: 7064)

    • Connects to the CnC server

      • svchost.exe (PID: 2284)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2284)
      • explorer.exe (PID: 7224)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 7224)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1912)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • Setup.tmp (PID: 4236)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 6352)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 3112)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Reads the Windows owner or organization settings

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Creates file in the systems drive root

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 7360)

    • Reads the date of Windows installation

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Reads security settings of Internet Explorer

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)
      • ScreenSketch.exe (PID: 1884)

    • Runs PING.EXE to delay simulation

      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 4236)

    • Get information on the list of running processes

      • cmd.exe (PID: 1720)
      • cmd.exe (PID: 6592)
      • Setup.tmp (PID: 4476)
      • cmd.exe (PID: 188)
      • cmd.exe (PID: 812)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 4104)
      • cmd.exe (PID: 7264)
      • Setup.tmp (PID: 4236)
      • cmd.exe (PID: 6232)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 7488)
      • cmd.exe (PID: 7508)

    • The process drops C-runtime libraries

      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • Setup.tmp (PID: 4236)

    • Starts CMD.EXE for commands execution

      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 4236)

    • Starts application with an unusual extension

      • ImPackr.exe (PID: 4940)
      • ImPackr.exe (PID: 1148)

    • Starts itself from another location

      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 7608)

    • The process creates files with name similar to system file names

      • Derby Loader.exe (PID: 396)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2284)
      • explorer.exe (PID: 7224)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)
      • Setup.exe (PID: 6352)
      • Taskmgr.exe (PID: 1596)
      • Taskmgr.exe (PID: 6124)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • mspaint.exe (PID: 7760)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5696)
      • WinRAR.exe (PID: 1912)

    • Checks proxy server information

      • slui.exe (PID: 2708)

    • Reads the software policy settings

      • slui.exe (PID: 2708)
      • explorer.exe (PID: 7224)

    • Checks supported languages

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • StrCmp.exe (PID: 5304)
      • more.com (PID: 3228)
      • Derby Loader.exe (PID: 396)
      • Setup.exe (PID: 7328)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 4236)
      • Setup.tmp (PID: 7360)
      • ImPackr.exe (PID: 7608)
      • ImPackr.exe (PID: 1148)
      • StrCmp.exe (PID: 7664)
      • more.com (PID: 7728)
      • ScreenSketch.exe (PID: 1884)

    • Reads Environment values

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.exe (PID: 7164)
      • Setup.tmp (PID: 4476)
      • Setup.exe (PID: 7328)
      • Setup.exe (PID: 5936)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Create files in a temporary directory

      • Setup.exe (PID: 6352)
      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.exe (PID: 7164)
      • ImPackr.exe (PID: 4940)
      • more.com (PID: 3228)
      • Setup.exe (PID: 5936)
      • Setup.exe (PID: 7328)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)
      • ImPackr.exe (PID: 1148)
      • more.com (PID: 7728)

    • Reads the computer name

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • StrCmp.exe (PID: 5304)
      • more.com (PID: 3228)
      • Derby Loader.exe (PID: 396)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)
      • ImPackr.exe (PID: 7608)
      • StrCmp.exe (PID: 7664)
      • more.com (PID: 7728)
      • ScreenSketch.exe (PID: 1884)
      • ImPackr.exe (PID: 1148)

    • Process checks computer location settings

      • Setup.tmp (PID: 3112)
      • Setup.tmp (PID: 4476)
      • Setup.tmp (PID: 7360)
      • Setup.tmp (PID: 4236)

    • Creates files or folders in the user directory

      • Setup.tmp (PID: 4476)
      • ImPackr.exe (PID: 7096)
      • ImPackr.exe (PID: 4940)
      • Setup.tmp (PID: 4236)
      • ScreenSketch.exe (PID: 1884)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 6124)

    • Reads the machine GUID from the registry

      • Derby Loader.exe (PID: 396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:29 23:10:18
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: #!!SetUp_2244_PassW0rd$/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
363
Monitored processes
217
Malicious processes
15
Suspicious processes
11

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe slui.exe slui.exe no specs winrar.exe setup.exe setup.tmp setup.exe setup.tmp ping.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs impackr.exe impackr.exe strcmp.exe no specs more.com no specs conhost.exe no specs taskmgr.exe no specs taskmgr.exe derby loader.exe ollydbg.exe no specs conhost.exe no specs pexplorer.exe no specs idag.exe no specs procanalyzer.exe no specs idag64.exe no specs processhacker.exe no specs idaq.exe no specs idaq64.exe no specs immunitydebugger.exe no specs tcpdump.exe no specs tcpview.exe no specs regshot.exe no specs conhost.exe no specs dumpcap.exe no specs windbg.exe no specs conhost.exe no specs wireshark.exe no specs conhost.exe no specs fiddler.exe no specs conhost.exe no specs x64dbg.exe no specs conhost.exe no specs x32dbg.exe no specs conhost.exe no specs bdoesrv.exe no specs conhost.exe no specs kavpf.exe no specs mantispm.exe no specs conhost.exe no specs avengine.exe no specs conhost.exe no specs fspex.exe no specs conhost.exe no specs mcshld9x.exe no specs conhost.exe no specs mgavrtcl.exe no specs avguard.exe no specs savservice.exe no specs coreserviceshell.exe no specs conhost.exe no specs avgrsx.exe no specs avgwdsvc.exe no specs avgtray.exe no specs avpgui.exe no specs kavfs.exe no specs kavfsrcn.exe no specs kavtray.exe no specs 360rp.exe no specs conhost.exe no specs pccntmon.exe no specs avp.exe no specs conhost.exe no specs mcshield.exe no specs conhost.exe no specs ashserv.exe no specs conhost.exe no specs avgemc.exe no specs conhost.exe no specs navapsvc.exe no specs conhost.exe no specs avgagent.exe no specs conhost.exe no specs f-agnt95.exe no specs conhost.exe no specs f-prot.exe no specs conhost.exe no specs kav.exe no specs conhost.exe no specs nod32krn.exe no specs conhost.exe no specs ccsvchst.exe no specs conhost.exe no specs semsvc.exe no specs conhost.exe no specs mctray.exe no specs masvc.exe no specs conhost.exe no specs bdagent.exe no specs avgcsrvx.exe no specs fssm32.exe no specs conhost.exe no specs avastsvc.exe no specs conhost.exe no specs vsserv.exe no specs sysinspector.exe no specs conhost.exe no specs ekrn.exe no specs conhost.exe no specs ossec-agent.exe no specs conhost.exe no specs osqueryd.exe no specs vmsrvc.exe no specs vmusrvc.exe no specs prl_cc.exe no specs prl_tools.exe no specs conhost.exe no specs xenservice.exe no specs conhost.exe no specs qemu-ga.exe no specs sbiectrl.exe no specs joeboxserver.exe no specs joeboxcontrol.exe no specs conhost.exe no specs sandboxierpcss.exe no specs conhost.exe no specs autoruns.exe no specs conhost.exe no specs autorunsc.exe no specs conhost.exe no specs filemon.exe no specs conhost.exe no specs procmon.exe no specs conhost.exe no specs regmon.exe no specs conhost.exe no specs procexp.exe no specs conhost.exe no specs procexp64.exe no specs conhost.exe no specs procmon64.exe no specs vboxservice.exe no specs conhost.exe no specs vboxtray.exe no specs conhost.exe no specs vmtoolsd.exe no specs conhost.exe no specs vmwareuser.exe no specs conhost.exe no specs vgauthservice.exe no specs conhost.exe no specs vmacthlp.exe no specs conhost.exe no specs vm3dservice.exe no specs conhost.exe no specs setup.exe setup.tmp setup.exe setup.tmp ping.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs impackr.exe no specs impackr.exe no specs strcmp.exe no specs #LUMMA explorer.exe more.com no specs conhost.exe no specs mspaint.exe no specs screensketch.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"C:\Windows\System32\cmd.exe—Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
204"C:\Users\admin\Desktop/bin/joeboxcontrol.exe"C:\Users\admin\Desktop\bin\joeboxcontrol.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\joeboxcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
208"C:\Users\admin\Desktop/bin/nod32krn.exe"C:\Users\admin\Desktop\bin\nod32krn.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\nod32krn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
396"C:\Users\admin\Desktop\Derby Loader.exe" C:\Users\admin\Desktop\Derby Loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Derby Loader
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\derby loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
504\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—joeboxcontrol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
524"C:\Users\admin\Desktop/bin/coreServiceShell.exe"C:\Users\admin\Desktop\bin\coreServiceShell.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\coreserviceshell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
788"C:\Users\admin\Desktop/bin/prl_tools.exe"C:\Users\admin\Desktop\bin\prl_tools.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\prl_tools.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
812"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"C:\Windows\System32\cmd.exe—Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
920"C:\Users\admin\Desktop/bin/prl_cc.exe"C:\Users\admin\Desktop\bin\prl_cc.exe—Derby Loader.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\bin\prl_cc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
996find /I "sophoshealth.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
35 238
Read events
35 080
Write events
136
Delete events
22

Modification events

(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000004204090000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F000000000000000000000000000000000000000000028020E000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000DE0210000000000000000000180000006400000000000000000000000000000003000000
Executable files
199
Suspicious files
13
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$.rar —
MD5:—
SHA256:—
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\PassCode.txt —
MD5:—
SHA256:—
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\Derby Loader.exeexecutable
MD5:6FFD80D50B23696822A2B1257B5ECDCA
SHA256:53AA0A310607A82ECAA86F75EBBD766783524EBB2A360B473A8FD7C0056C57A6
5696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5696.30494\#!!SetUp_2244_PassW0rd$\#!!SetUp_2244_PassW0rd$\Key.pngimage
MD5:322CFA2F21842153ACDEDCC58DE91389
SHA256:941A0B3C595E841BCC19D272FA1BB7A86E7EE348B37EF5E2177AC7286EF601E9
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-string-l1-1-0.dllexecutable
MD5:2E5C29FC652F432B89A1AFE187736C4D
SHA256:3807DB7ACF1B40C797E4D4C14A12C3806346AE56B25E205E600BE3E635C18D4F
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-processthreads-l1-1-1.dllexecutable
MD5:29001F316CCFC800E2246743DF9B15B3
SHA256:E5EA2C21FB225090F7D0DB6C6990D67B1558D8E834E86513BC8BA7A43C4E7B36
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-profile-l1-1-0.dllexecutable
MD5:6EE66DCA31C5CCE57740D677C85B4CE7
SHA256:D00A0EDACE14715BF79DBD17B715D8A74A2300F0ADB1F3FC137EDFB7074C9B0A
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-rtlsupport-l1-1-0.dllexecutable
MD5:0069FD29263C0DD90314C48BBCE852EF
SHA256:D11093FDC1D5C9213B9B2886CE91DB3DED17EF8DAE1615A8C7FFBC55B8E3F79B
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\x86\api-ms-win-core-synch-l1-1-0.dllexecutable
MD5:979C67BA244E5328A1A2E588FF748E86
SHA256:8BB38A7A59FBAA792B3D5F34F94580429588C8C592929CBD307AFD5579762ABC
1912WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1912.32879\PassCode.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
45
DNS requests
26
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
504
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
92.123.104.52:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2432
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2708
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.52
  • 92.123.104.47
  • 92.123.104.32
  • 92.123.104.46
  • 92.123.104.28
  • 92.123.104.33
  • 92.123.104.26
  • 92.123.104.31
  • 92.123.104.30
  • 92.123.104.59
  • 92.123.104.67
  • 92.123.104.18
  • 92.123.104.53
  • 92.123.104.65
  • 92.123.104.61
  • 92.123.104.10
whitelisted
google.com
  • 142.250.185.174
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 20.198.162.76
  • 40.115.3.253
whitelisted
th.bing.com
  • 92.123.104.30
  • 92.123.104.32
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.34
  • 92.123.104.47
  • 92.123.104.53
  • 92.123.104.33
  • 92.123.104.31
whitelisted

Threats

PID
Process
Class
Message
2284
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (horizonvxjis .shop)
2284
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (horizonvxjis .shop)
7224
explorer.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
7224
explorer.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
7224
explorer.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Lumma Stealer Related Domain (horizonvxjis .shop in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#!!SetUp_2244_PassW0rd$.zip