File name:

AME Wizard Beta.zip

Full analysis: https://app.any.run/tasks/978acc7f-93b0-4486-a4fa-7f10c417e679
Verdict: Malicious activity
Analysis date: February 16, 2025, 15:00:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
mimikatz
tools
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

FF4D9D30388CFA02551BCA527F764181

SHA1:

E8876F162EEB70FFEC1B3A6EFC457EE394D67738

SHA256:

5141BB7FB0B9A6B1ECF82D40EE5E53EAF4A772BAC8DE94649323C9F7F206A149

SSDEEP:

98304:tB7Il/en31llscCp7Eeg6g5hX/TNM38CCAyC+f8NXK/WEqvjXrWCR09cf0kNlvbL:F6hg8GZlgRHRMmFGKY5Ta

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6476)

    • MIMIKATZ has been detected (YARA)

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AME Wizard Beta.exe (PID: 3640)

    • Drops 7-zip archiver for unpacking

      • AME Wizard Beta.exe (PID: 3640)

    • The process creates files with name similar to system file names

      • AME Wizard Beta.exe (PID: 3640)

    • Process drops legitimate windows executable

      • AME Wizard Beta.exe (PID: 3640)

    • The process drops C-runtime libraries

      • AME Wizard Beta.exe (PID: 3640)

    • Reads security settings of Internet Explorer

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

    • Reads the date of Windows installation

      • AME Wizard Beta.exe (PID: 3640)

    • Application launched itself

      • AME Wizard Beta.exe (PID: 3640)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6476)

    • Reads the machine GUID from the registry

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

    • Checks supported languages

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

    • Reads the computer name

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

    • Manual execution by a user

      • AME Wizard Beta.exe (PID: 3640)

    • The sample compiled with english language support

      • AME Wizard Beta.exe (PID: 3640)

    • Create files in a temporary directory

      • AME Wizard Beta.exe (PID: 3640)

    • Creates files in the program directory

      • AME Wizard Beta.exe (PID: 3640)
      • AME Wizard Beta.exe (PID: 5340)

    • Reads Environment values

      • AME Wizard Beta.exe (PID: 3640)

    • Process checks computer location settings

      • AME Wizard Beta.exe (PID: 3640)

    • Checks proxy server information

      • AME Wizard Beta.exe (PID: 3640)

    • Reads the software policy settings

      • AME Wizard Beta.exe (PID: 3640)

    • Disables trace logs

      • AME Wizard Beta.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:12:05 22:02:50
ZipCRC: 0x4dd100d7
ZipCompressedSize: 10738944
ZipUncompressedSize: 18486784
ZipFileName: AME Wizard Beta.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #MIMIKATZ ame wizard beta.exe #MIMIKATZ ame wizard beta.exe

Process information

PID
CMD
Path
Indicators
Parent process
3640"C:\Users\admin\Desktop\AME Wizard Beta.exe" C:\Users\admin\Desktop\AME Wizard Beta.exe
explorer.exe
User:
admin
Company:
Ameliorated LLC
Integrity Level:
MEDIUM
Description:
AME Wizard
Version:
0.7.7
Modules
Images
c:\users\admin\desktop\ame wizard beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5340"C:\Users\admin\Desktop\AME Wizard Beta.exe" "C:\Users\admin\AppData\Local\Temp\AME" Interprocess Administrator --Mode TwoWay --Nodes Level=User:ProcessID=3640 --Host 3640C:\Users\admin\Desktop\AME Wizard Beta.exe
AME Wizard Beta.exe
User:
admin
Company:
Ameliorated LLC
Integrity Level:
HIGH
Description:
AME Wizard
Version:
0.7.7
Modules
Images
c:\users\admin\desktop\ame wizard beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6476"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AME Wizard Beta.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
4 360
Read events
4 328
Write events
32
Delete events
0

Modification events

(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AME Wizard Beta.zip
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
52
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
6476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6476.34082\AME Wizard Beta.exeexecutable
MD5:C44B28A9B41F37AAB0898FBC6E128F43
SHA256:F09105EB7BCF102C8F6D77073D4575F1244EC7CD0B94ACD87C2DC3519BF18B19
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\JetBrains.Annotations.dllexecutable
MD5:A657FFD11DBBAED200F6A42B5B164D2A
SHA256:5494939D0B986B953582FA150435B0CC784B180A214EE4DCCA9785058E585B6F
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\FluentIcons.WPF.dllexecutable
MD5:F4FF2C4F31AE8C973050BB469C427B5A
SHA256:255BBF677B4AA364B529228D6E56E6ADFFF469BDA212B497485F9A87B82BCC4D
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Microsoft.Bcl.AsyncInterfaces.dllexecutable
MD5:FF34978B62D5E0BE84A895D9C30F99AE
SHA256:80678203BD0203A6594F4E330B22543C0DE5059382BB1C9334B7868B8F31B1BC
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\FluentIcons.Common.dllexecutable
MD5:93B2FC669F12BBFE5D7F95DE850B5AE0
SHA256:006B593E445FA07F9C717C9FC4A4928A133E59ED0B5EBA7C1F07BFBF3E7D430E
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Microsoft.Bcl.TimeProvider.dllexecutable
MD5:37E25D107CE1385DF1474780CBFA4636
SHA256:693242B67DA91AF78DDA4B91D6020E0B8CDA08D4C9102177A12522009EF9B940
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\DiscUtils.Wim.dllexecutable
MD5:6DBB6E2A69CADD7AD06884B848880510
SHA256:2D290582F7CDD6D1C361DA310E3151AFFF0679E3EB2A44DA6C08A3EFDE00D083
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Polly.Core.dllexecutable
MD5:AAE5FAC4C683D7A95878DAB718E6574C
SHA256:1244DBCE7E86FE8C8D0D5174B68614953F0D793FC222011BB4DE61F9537415EF
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Newtonsoft.Json.dllexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
3640AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\msvcp140.dllexecutable
MD5:1BA6D1CF0508775096F9E121A24E5863
SHA256:74892D9B4028C05DEBAF0B9B5D9DC6D22F7956FA7D7EEE00C681318C26792823
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
30
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6748
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6440
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6440
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
440
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6440
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.20
  • 20.190.160.14
  • 20.190.160.65
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.64
  • 20.190.160.2
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
api.github.com
  • 140.82.121.6
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AME Wizard Beta.zip