File name:

SnazSetup (1).exe

Full analysis: https://app.any.run/tasks/34c2888c-7110-4fa4-85a3-7d386b9f6e15
Verdict: Malicious activity
Analysis date: March 04, 2024, 12:17:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E09850C09B8FE0FE264D437000A51E51

SHA1:

6346853A9E518434CA62CA744EB5F67A0D2B34A8

SHA256:

88B2DA2760004A0C441EF0FC9A58F38AB82684A5C3B5E22BD2D6B9AB2411C774

SSDEEP:

98304:0h9fquImhBaSeJ43EBCTrOgOVF+4MVICZRIEEBnSPLotEE98uGL7bSD8VF4TRZgC:v9EK3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)

    • Reads the Windows owner or organization settings

      • SnazSetup (1).tmp (PID: 2752)

    • Reads security settings of Internet Explorer

      • Snaz.exe (PID: 4060)

    • Reads the Internet Settings

      • Snaz.exe (PID: 4060)

    • Reads settings of System Certificates

      • Snaz.exe (PID: 4060)

    • Adds/modifies Windows certificates

      • Snaz.exe (PID: 4060)

  • INFO

    • Checks supported languages

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).tmp (PID: 2160)
      • SnazSetup (1).exe (PID: 2964)
      • SnazSetup (1).tmp (PID: 2752)
      • Snaz.exe (PID: 4060)

    • Create files in a temporary directory

      • SnazSetup (1).exe (PID: 3864)
      • SnazSetup (1).exe (PID: 2964)

    • Reads the computer name

      • SnazSetup (1).tmp (PID: 2160)
      • SnazSetup (1).tmp (PID: 2752)
      • Snaz.exe (PID: 4060)

    • Creates files in the program directory

      • SnazSetup (1).tmp (PID: 2752)

    • Creates a software uninstall entry

      • SnazSetup (1).tmp (PID: 2752)

    • Reads the machine GUID from the registry

      • Snaz.exe (PID: 4060)

    • Reads Environment values

      • Snaz.exe (PID: 4060)

    • Reads the software policy settings

      • Snaz.exe (PID: 4060)

    • Creates files or folders in the user directory

      • Snaz.exe (PID: 4060)

    • Reads Microsoft Office registry keys

      • Snaz.exe (PID: 4060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (81.5)
.exe | Win32 Executable Delphi generic (10.5)
.exe | Win32 Executable (generic) (3.3)
.exe | Win16/32 Executable Delphi generic (1.5)
.exe | Generic Win/DOS Executable (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41472
InitializedDataSize: 332800
UninitializedDataSize: -
EntryPoint: 0xaa98
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.12.7.0
ProductVersionNumber: 1.12.7.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: JimsApps
FileDescription: Snaz Setup
FileVersion: 1.12.7.0
LegalCopyright:
ProductName: Snaz
ProductVersion: 1.12.7.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start snazsetup (1).exe snazsetup (1).tmp no specs snazsetup (1).exe snazsetup (1).tmp snaz.exe

Process information

PID
CMD
Path
Indicators
Parent process
2160"C:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmp" /SL5="$E0170,1210711,375296,C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" C:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmp—SnazSetup (1).exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-pi09e.tmp\snazsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2752"C:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmp" /SL5="$19013E,1210711,375296,C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmp
SnazSetup (1).exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hvknj.tmp\snazsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2964"C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe
SnazSetup (1).tmp
User:
admin
Company:
JimsApps
Integrity Level:
HIGH
Description:
Snaz Setup
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\users\admin\appdata\local\temp\snazsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3864"C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe" C:\Users\admin\AppData\Local\Temp\SnazSetup (1).exe
explorer.exe
User:
admin
Company:
JimsApps
Integrity Level:
MEDIUM
Description:
Snaz Setup
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\users\admin\appdata\local\temp\snazsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
4060"C:\Snaz\Snaz.exe"C:\Snaz\Snaz.exe
SnazSetup (1).tmp
User:
admin
Company:
JimsApps
Integrity Level:
MEDIUM
Description:
Snaz
Exit code:
0
Version:
1.12.7.0
Modules
Images
c:\snaz\snaz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
13 164
Read events
13 074
Write events
64
Delete events
26

Modification events

(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
C00A0000503F88F22D6EDA01
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8887AC67EA87EA3DC9BDC5B59798DE35CC8442CDF03A5F70F8878CB9C559F18F
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Snaz\Snaz.exe
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
740B8E268F94780CECB10AB5510162E5CE7AA4C26C55DBD0A73076D50FC1BA7D
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (a)
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Snaz
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:InstallLocation
Value:
C:\Snaz\
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Snaz
(PID) Process:(2752) SnazSetup (1).tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{70A76031-FDC6-4F9B-BB5C-33776703F45A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
18
Suspicious files
4
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
2964SnazSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-HVKNJ.tmp\SnazSetup (1).tmpexecutable
MD5:E5875F0A3882D00CD2BA7C254C1C6F79
SHA256:15E22EA8BF9E14A04D9B6EC7AEBEED016C8A6D8BF2BAE07B265EF6B3DE273D70
3864SnazSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-PI09E.tmp\SnazSetup (1).tmpexecutable
MD5:E5875F0A3882D00CD2BA7C254C1C6F79
SHA256:15E22EA8BF9E14A04D9B6EC7AEBEED016C8A6D8BF2BAE07B265EF6B3DE273D70
2752SnazSetup (1).tmpC:\Snaz\is-3OPAP.tmpexecutable
MD5:1D6D3254BCBDC2FF17716A3B87D0F326
SHA256:CB25D98B3ACF75D86511B0EDF384D742E0B63F721E4FFA20572E5CA133C300E3
2752SnazSetup (1).tmpC:\Snaz\unins000.exeexecutable
MD5:33B367A2E0A2CEDF07EB3926EBB25EE9
SHA256:4094203E4472A52632C197A03175B3F926BE15AD0022B91EE276269F99CB20BB
2752SnazSetup (1).tmpC:\Snaz\Snaz.exe.configxml
MD5:D0678467C7CCEF643A5EE1D5F69B608A
SHA256:FF3100BFB87E78A99BA7BC459903015CB8B93A558C3DADE5FD7CC2CA2CE48F36
2752SnazSetup (1).tmpC:\Snaz\TextFiles\is-C9L7D.tmp —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\Time.txt —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\is-4ERQ0.tmp —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\TextFiles\Date.txt —
MD5:—
SHA256:—
2752SnazSetup (1).tmpC:\Snaz\SpotifyAPI.dllexecutable
MD5:C91214A9152FD39F3239DB7056A4E3A8
SHA256:6B454F1EE273E6A375579633478738FA999A381593FCFDD38A1B3824F47D12C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4060
Snaz.exe
GET
301
18.192.94.96:80
http://jimmyappelt.be/Downloads/Software/Snaz/AutoUpdater.NET_AppCast.xml
unknown
text
89 b
unknown
4060
Snaz.exe
GET
301
18.192.231.252:80
http://www.jimmyappelt.be/Downloads/Software/Snaz/remoteMessage.txt
unknown
text
83 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4060
Snaz.exe
18.192.94.96:80
jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.231.252:80
www.jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.94.96:443
jimmyappelt.be
AMAZON-02
DE
unknown
4060
Snaz.exe
18.192.231.252:443
www.jimmyappelt.be
AMAZON-02
DE
unknown

DNS requests

Domain
IP
Reputation
jimmyappelt.be
  • 18.192.94.96
  • 3.72.140.173
unknown
www.jimmyappelt.be
  • 18.192.231.252
  • 18.192.94.96
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SnazSetup (1).exe