File name:

Niepotwierdzony 495948.crdownload

Full analysis: https://app.any.run/tasks/3b3c3029-2696-44d4-958e-c8ab12d7d03c
Verdict: Malicious activity
Threats:

Maze is ransomware — a malware type that encrypts the victim’s files and restores the data in exchange for a ransom payment. One of the most distinguishable features of Maze is that it is one of the first malware of the kind to publicly release stolen data.

Malware Trends Tracker     >>>
Analysis date: September 18, 2023, 18:37:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
maze
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

A024E1D53D75EAEFC4AA74131FF16FD8

SHA1:

CFD053A7E793EC84EC78679F224B417C760E0A5E

SHA256:

77B2731FF3C7A14B8B962EA387C41293415B3478E73973888851991105777560

SSDEEP:

12288:6Zr2Dvm+2LDF+jgcz5jCDiIuexi3FBUzvASSB7d:6ZCDvmRLDwjPrIuekUz4SS5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Deletes shadow copies

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Maze is detected

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Steals credentials from Web Browsers

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Modifies files in the Chrome extension folder

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Actions looks like stealing of personal data

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

  • SUSPICIOUS

    • Reads the Internet Settings

      • WMIC.exe (PID: 2288)
      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Connects to the server without a host name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 2804)
      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2804)
      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2804)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2804)
      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Reads product name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Reads Environment values

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Creates files in the program directory

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Creates files or folders in the user directory

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)

    • Checks proxy server information

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 1468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
ZipUncompressedSize: 484352
ZipCompressedSize: 427125
ZipCRC: 0x3e6fd65f
ZipModifyDate: 2020:12:06 13:31:08
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe no specs wmpnscfg.exe no specs #MAZE e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1468"C:\Users\admin\AppData\Local\Temp\Rar$EXb3484.22642\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3484.22642\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3484.22642\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2288"C:\rrkex\..\Windows\dqq\sbmfr\q\..\..\..\system32\k\s\..\..\wbem\e\tfjob\xx\..\..\..\wmic.exe" shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2804"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Niepotwierdzony 495948.crdownload.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
1 531
Read events
1 500
Write events
28
Delete events
3

Modification events

(PID) Process:(3484) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2804) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{06DDBC73-69B8-4CBE-B80B-F7ED7726569B}\{02A82D5A-4D3A-4E8B-BCF7-410C510C4386}
Operation:delete keyName:(default)
Value:
(PID) Process:(2804) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{06DDBC73-69B8-4CBE-B80B-F7ED7726569B}
Operation:delete keyName:(default)
Value:
Executable files
18
Suspicious files
3 802
Text files
548
Unknown types
0

Dropped files

PID
Process
Filename
Type
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\MSOCache\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
3484WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3484.22642\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeexecutable
MD5:F83FB9CE6A83DA58B20685C1D7E1E546
SHA256:E8A091A84DD2EA7EE429135FF48E9F48F7787637CCB79F6C3EB42F34588BC684
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\VirtualStore\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestampbinary
MD5:4D001FF7EC1AF786567CC771D3C4647C
SHA256:3E35DA613FBF0A1EFAE7D59112CA00BC35C980E3679C493C833D6270B96EC501
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\ProgramData\foo.dbbinary
MD5:76F8F28BD51EFA03AB992FDB050C8382
SHA256:5470F0644589685000154CB7D3F60280ACB16E39CA961CCE2C016078B303BC1B
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.Mkhabinary
MD5:4D001FF7EC1AF786567CC771D3C4647C
SHA256:3E35DA613FBF0A1EFAE7D59112CA00BC35C980E3679C493C833D6270B96EC501
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
1468e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\DECRYPT-FILES.htmlhtml
MD5:9E6913A1311B98F65C6B7341801109E4
SHA256:2868018258231EA7B8845BEF66D5A98820BAB612428D6E0B4696AF0348595152
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
0
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.32.2:80
http://92.63.32.2/content/withdrawal/miak.php
unknown
—
—
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.37.100:80
http://92.63.37.100/archive/forum/ytxf.jsp
unknown
—
—
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.8.47:80
http://92.63.8.47/webauth/signout/bxauamq.shtml?hvy=au2s52k
unknown
—
—
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.8.47:80
http://92.63.8.47/webauth/signout/bxauamq.shtml?hvy=au2s52k
unknown
—
—
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.32.2:80
http://92.63.32.2/content/withdrawal/miak.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
92.63.8.47:80
—
Netonline Bilisim Sirketi LTD
CY
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
92.63.32.2:80
—
MGK Rafal Chmielewski
PL
unknown
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
92.63.37.100:80
—
MGK Rafal Chmielewski
PL
unknown

DNS requests

No data

Threats

PID
Process
Class
Message
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
A Network Trojan was detected
ET MALWARE Maze/ID Ransomware Activity
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
A Network Trojan was detected
ET MALWARE Maze/ID Ransomware Activity
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
A Network Trojan was detected
ET MALWARE Maze/ID Ransomware Activity
1468
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
A Network Trojan was detected
ET MALWARE Maze/ID Ransomware Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Niepotwierdzony 495948.crdownload