File name:

SnazSetup (1).exe

Full analysis: https://app.any.run/tasks/34c2888c-7110-4fa4-85a3-7d386b9f6e15
Verdict: Malicious activity
Analysis date: March 04, 2024, 12:17:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E09850C09B8FE0FE264D437000A51E51

SHA1:

6346853A9E518434CA62CA744EB5F67A0D2B34A8

SHA256:

88B2DA2760004A0C441EF0FC9A58F38AB82684A5C3B5E22BD2D6B9AB2411C774

SSDEEP:

98304:0h9fquImhBaSeJ43EBCTrOgOVF+4MVICZRIEEBnSPLotEE98uGL7bSD8VF4TRZgC:v9EK3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)

    • Reads the Windows owner or organization settings

      • SnazSetup (1).tmp (PID: 2752)

    • Reads the Internet Settings

      • Snaz.exe (PID: 4060)

    • Reads security settings of Internet Explorer

      • Snaz.exe (PID: 4060)

    • Reads settings of System Certificates

      • Snaz.exe (PID: 4060)

    • Adds/modifies Windows certificates

      • Snaz.exe (PID: 4060)

  • INFO

    • Create files in a temporary directory

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)

    • Checks supported languages

      • SnazSetup (1).tmp (PID: 2160)
      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)
      • Snaz.exe (PID: 4060)

    • Reads the computer name

      • SnazSetup (1).tmp (PID: 2160)
      • SnazSetup (1).tmp (PID: 2752)
      • Snaz.exe (PID: 4060)

    • Creates files in the program directory

      • SnazSetup (1).tmp (PID: 2752)

    • Creates a software uninstall entry

      • SnazSetup (1).tmp (PID: 2752)

    • Reads the machine GUID from the registry

      • Snaz.exe (PID: 4060)

    • Reads Microsoft Office registry keys

      • Snaz.exe (PID: 4060)

    • Creates files or folders in the user directory

      • Snaz.exe (PID: 4060)

    • Reads the software policy settings

      • Snaz.exe (PID: 4060)

    • Reads Environment values

      • Snaz.exe (PID: 4060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (81.5)
.exe | Win32 Executable Delphi generic (10.5)
.exe | Win32 Executable (generic) (3.3)
.exe | Win16/32 Executable Delphi generic (1.5)
.exe | Generic Win/DOS Executable (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41472
InitializedDataSize: 332800
UninitializedDataSize: -
EntryPoint: 0xaa98
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.12.7.0
ProductVersionNumber: 1.12.7.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: JimsApps
FileDescription: Snaz Setup
FileVersion: 1.12.7.0
LegalCopyright:
ProductName: Snaz
ProductVersion: 1.12.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start snazsetup (1).exe snazsetup (1).tmp no specs snazsetup (1).exe snazsetup (1).tmp snaz.exe

Process information

PID
CMD
Path
Indicators
Parent process
2160"C:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmp" /SL5="$E0170,1210711,375296,C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" C:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmp—SnazSetup (1).exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-pi09e.tmp\snazsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2752"C:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmp" /SL5="$19013E,1210711,375296,C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmp
SnazSetup (1).exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hvknj.tmp\snazsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2964"C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe
SnazSetup (1).tmp
User:
admin
Company:
JimsApps
Integrity Level:
HIGH
Description:
Snaz Setup
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\users\admin\appdata\local\temp\snazsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3864"C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe
explorer.exe
User:
admin
Company:
JimsApps
Integrity Level:
MEDIUM
Description:
Snaz Setup
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\users\admin\appdata\local\temp\snazsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
4060"C:\Snaz\Snaz.exe"C:\Snaz\Snaz.exe
SnazSetup (1).tmp
User:
admin
Company:
JimsApps
Integrity Level:
MEDIUM
Description:
Snaz
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\snaz\snaz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
13 164
Read events
13 074
Write events
64
Delete events
26

Modification events

(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
C00A0000503F88F22D6EDA01
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8887AC67EA87EA3DC9BDC5B59798DE35CC8442CDF03A5F70F8878CB9C559F18F
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Snaz\Snaz.exe
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
740B8E268F94780CECB10AB5510162E5CE7AA4C26C55DBD0A73076D50FC1BA7D
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (a)
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Snaz
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:InstallLocation
Value:
C:\Snaz\
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Snaz
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
18
Suspicious files
4
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
2752SnazSetup (1).tmpC:\Snaz\Snaz.exeexecutable
MD5:21B8A5A85EB993884DF4F39E3A4D9683
SHA256:7733A343507B4AE081D0C07AD70171B330D42ED9254FC50670EF24E6D430A55D
2964SnazSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmpexecutable
MD5:E5875F0A3882D00CD2BA7C254C1C6F79
SHA256:15E22EA8BF9E14A04D9B6EC7AEBEED016C8A6D8BF2BAE07B265EF6B3DE273D70
2752SnazSetup (1).tmpC:\Snaz\Interop.iTunesLib.dllexecutable
MD5:B2E2C9479D7981FB82EC6DB28877DDB9
SHA256:7CE1734524026DD7AEEA9B105F795F938F451CFD6C8ECC899B59497F3FB35C4D
2752SnazSetup (1).tmpC:\Snaz\is-H7VES.tmpexecutable
MD5:21B8A5A85EB993884DF4F39E3A4D9683
SHA256:7733A343507B4AE081D0C07AD70171B330D42ED9254FC50670EF24E6D430A55D
3864SnazSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmpexecutable
MD5:E5875F0A3882D00CD2BA7C254C1C6F79
SHA256:15E22EA8BF9E14A04D9B6EC7AEBEED016C8A6D8BF2BAE07B265EF6B3DE273D70
2752SnazSetup (1).tmpC:\Snaz\TextFiles\is-C9L7D.tmp —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\Time.txt —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\is-4ERQ0.tmp —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\Date.txt —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\is-3OPAP.tmpexecutable
MD5:1D6D3254BCBDC2FF17716A3B87D0F326
SHA256:CB25D98B3ACF75D86511B0EDF384D742E0B63F721E4FFA20572E5CA133C300E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4060
Snaz.exe
GET
301
18.192.94.96:80
http://jimmyappelt.be/Downloads/Software/Snaz/AutoUpdater.NET_AppCast.xml
unknown
text
89 b
—
4060
Snaz.exe
GET
301
18.192.231.252:80
http://www.jimmyappelt.be/Downloads/Software/Snaz/remoteMessage.txt
unknown
text
83 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4060
Snaz.exe
18.192.94.96:80
jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.231.252:80
www.jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.94.96:443
jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.231.252:443
www.jimmyappelt.be
AMAZON-02
DE
unknown

DNS requests

Domain
IP
Reputation
jimmyappelt.be
  • 18.192.94.96
  • 3.72.140.173
unknown
www.jimmyappelt.be
  • 18.192.231.252
  • 18.192.94.96
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SnazSetup (1).exe