analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f83fb9ce6a83da58b20685c1d7e1e546.zip

Full analysis: https://app.any.run/tasks/685fa2f9-5b74-439a-99cf-0d11059e2b14
Verdict: Malicious activity
Threats:

Maze is ransomware — a malware type that encrypts the victim’s files and restores the data in exchange for a ransom payment. One of the most distinguishable features of Maze is that it is one of the first malware of the kind to publicly release stolen data.

Malware Trends Tracker     >>>
Analysis date: December 05, 2022, 18:11:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
maze
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

A024E1D53D75EAEFC4AA74131FF16FD8

SHA1:

CFD053A7E793EC84EC78679F224B417C760E0A5E

SHA256:

77B2731FF3C7A14B8B962EA387C41293415B3478E73973888851991105777560

SSDEEP:

12288:6Zr2Dvm+2LDF+jgcz5jCDiIuexi3FBUzvASSB7d:6ZCDvmRLDwjPrIuekUz4SS5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Maze ransom note is found

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 3064)

    • Application was dropped or rewritten from another process

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2296)
      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 3064)

    • Drops the executable file immediately after the start

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 3064)

  • SUSPICIOUS

    • Connects to the server without a host name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 3064)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe no specs #MAZE e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe explorer.exe no specs wmic.exe no specs winrar.exe no specs e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\f83fb9ce6a83da58b20685c1d7e1e546.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3064"C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.38131\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1328.38131\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1328.38131\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3704"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
372"C:\ndexw\s\ckg\..\..\..\Windows\he\qafqd\disl\..\..\..\system32\haq\lq\pvhk\..\..\..\wbem\alpu\h\..\..\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe—e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3460"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\f83fb9ce6a83da58b20685c1d7e1e546.zip" C:\Users\admin\Downloads\C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2296"C:\Users\admin\Downloads\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe" C:\Users\admin\Downloads\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\downloads\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
1 530
Read events
1 492
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1 050
Text files
330
Unknown types
31

Dropped files

PID
Process
Filename
Type
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.B7bfjIGbinary
MD5:E63FE2328858FD0E657A73FDD5909DE7
SHA256:D402BC1DDD09FA83A329E476C5C267736DE6D80FBE90A8AB18B3B89B8C720FDC
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\VirtualStore\DECRYPT-FILES.htmlhtml
MD5:75196D0A79109117BF8BE36A89EDF771
SHA256:87BE39CAA5D918CD0DF2CF5AD588DA449E9388EB890087566C5C43C78669B53A
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\DECRYPT-FILES.htmlhtml
MD5:75196D0A79109117BF8BE36A89EDF771
SHA256:87BE39CAA5D918CD0DF2CF5AD588DA449E9388EB890087566C5C43C78669B53A
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\DECRYPT-FILES.htmlhtml
MD5:75196D0A79109117BF8BE36A89EDF771
SHA256:87BE39CAA5D918CD0DF2CF5AD588DA449E9388EB890087566C5C43C78669B53A
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\96458326-0F6E-4F95-88EE-ED9F0B2D5401binary
MD5:5F6540871807AE3F51ADC93651AA9027
SHA256:20D6F6A117A9A047ED43E2755B84F526AE5951547E400EB489B49EB231E95905
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\Adobe\DECRYPT-FILES.htmlhtml
MD5:75196D0A79109117BF8BE36A89EDF771
SHA256:87BE39CAA5D918CD0DF2CF5AD588DA449E9388EB890087566C5C43C78669B53A
1328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1328.38131\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeexecutable
MD5:F83FB9CE6A83DA58B20685C1D7E1E546
SHA256:E8A091A84DD2EA7EE429135FF48E9F48F7787637CCB79F6C3EB42F34588BC684
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestampbinary
MD5:E63FE2328858FD0E657A73FDD5909DE7
SHA256:D402BC1DDD09FA83A329E476C5C267736DE6D80FBE90A8AB18B3B89B8C720FDC
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\MSOCache\DECRYPT-FILES.htmlhtml
MD5:75196D0A79109117BF8BE36A89EDF771
SHA256:87BE39CAA5D918CD0DF2CF5AD588DA449E9388EB890087566C5C43C78669B53A
3064e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\close_200.png.Mhpcbinary
MD5:D9E00CDD975672F3020FD683D69DABB6
SHA256:726F95FDD7F354408533862BFEFEF46BA5AC9590B70C98B93ACA6F15EEA5805E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3064
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
—
92.63.8.47:80
http://92.63.8.47/analytics/ecrsteudv.aspx?vqu=p51bji&gexc=86ehb5k
TR
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
92.63.8.47:80
—
Netonline Bilisim Sirketi LTD
CY
malicious

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f83fb9ce6a83da58b20685c1d7e1e546.zip