File name:

AME Wizard Beta.zip

Full analysis: https://app.any.run/tasks/1ca21157-943a-4fc8-b9ec-77aa659ff34d
Verdict: Malicious activity
Analysis date: November 19, 2024, 08:54:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
mimikatz
tools
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

2BE41DB4186F769FF9108231E75C1DA5

SHA1:

935B4A8EC709220A43228AEBB32C3EEFC1A777D4

SHA256:

C982B80CFFB5CF6958CC145D4524E3D434D4047280E21EEF6EE5770C3A50E435

SSDEEP:

98304:c4/cb3SAdO3U8Cv5ykY/btM3THiYETbKscNQzTHO+rw1K+EMxNgNl9jFA5YXZ1n5:btZh+S3guCfyS03PT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5180)

    • MIMIKATZ has been detected (YARA)

      • AME Wizard Beta.exe (PID: 5780)
      • AME Wizard Beta.exe (PID: 6168)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • AME Wizard Beta.exe (PID: 5780)

    • Executable content was dropped or overwritten

      • AME Wizard Beta.exe (PID: 5780)

    • Process drops legitimate windows executable

      • AME Wizard Beta.exe (PID: 5780)

    • The process drops C-runtime libraries

      • AME Wizard Beta.exe (PID: 5780)

    • Application launched itself

      • AME Wizard Beta.exe (PID: 5780)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5180)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5180)

    • Manual execution by a user

      • AME Wizard Beta.exe (PID: 5780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:09:09 19:25:42
ZipCRC: 0xffa81c28
ZipCompressedSize: 10741019
ZipUncompressedSize: 18487808
ZipFileName: AME Wizard Beta.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #MIMIKATZ ame wizard beta.exe #MIMIKATZ ame wizard beta.exe

Process information

PID
CMD
Path
Indicators
Parent process
5180"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AME Wizard Beta.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5780"C:\Users\admin\Desktop\AME Wizard Beta.exe" C:\Users\admin\Desktop\AME Wizard Beta.exe
explorer.exe
User:
admin
Company:
Ameliorated LLC
Integrity Level:
MEDIUM
Description:
AME Wizard
Version:
0.7.6
Modules
Images
c:\users\admin\desktop\ame wizard beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6168"C:\Users\admin\Desktop\AME Wizard Beta.exe" "C:\Users\admin\AppData\Local\Temp\AME" Interprocess Administrator --Mode TwoWay --Nodes Level=User:ProcessID=5780 --Host 5780C:\Users\admin\Desktop\AME Wizard Beta.exe
AME Wizard Beta.exe
User:
admin
Company:
Ameliorated LLC
Integrity Level:
HIGH
Description:
AME Wizard
Version:
0.7.6
Modules
Images
c:\users\admin\desktop\ame wizard beta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 233
Read events
4 201
Write events
32
Delete events
0

Modification events

(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AME Wizard Beta.zip
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(5180) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
52
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\client-helper.dllexecutable
MD5:37FAF38D69284BDA23E383C000D946A3
SHA256:0C84C4F52A981B57DA3C639D7F96DE0BD3E366C241B14972BA8A5F6D396DBD54
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\7zxa.dllexecutable
MD5:BC3754B7C77DFB6AED1722EF7F53B414
SHA256:B54CAC90E649EBBF7C27CF1772F5C1644F4600DB88F0D51419A3529A5A5F95FC
5180WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5180.28404\AME Wizard Beta.exeexecutable
MD5:3725BE198E6BC6B8AEC46060F3CFC2E4
SHA256:AC2C0A54AC444CD2B093CC74BCDE2EAE1C9B154F1D1393C312165C8BECEB8347
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\7za.dllexecutable
MD5:58FDBF10D3DCE4D2E270C03E8311D9DB
SHA256:0BBCC7BFC688A512911FBE679BBD279928F1B463431139685EBE39A98798134E
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\DiscUtils.Iso9660.dllexecutable
MD5:C7340CDF1E4AF72C007FE68694B7ECB5
SHA256:4AA30F253343F3E130F4FF8DF0E955232134F339FFCB279CB8FE22A05ACC727D
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Ben.Demystifier.dllexecutable
MD5:965D07F46CD56AE2A4F310921230C206
SHA256:F49EC56E6D8DD1029F990C08DBFC8CA7C5E8EDD353D8D7BA35FAE2C6ADCAA1C9
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\Microsoft.Bcl.AsyncInterfaces.dllexecutable
MD5:FF34978B62D5E0BE84A895D9C30F99AE
SHA256:80678203BD0203A6594F4E330B22543C0DE5059382BB1C9334B7868B8F31B1BC
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\DiscUtils.Streams.dllexecutable
MD5:E4229054374707ACECE62079A0037610
SHA256:4275A6241646141419D97E30ACAB3B2D7F4CDA51B5ADC9BB12F9C8B385022D51
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\DiscUtils.Udf.dllexecutable
MD5:2713C8E7C1FA41CFDB28D803B4F9E41C
SHA256:0A591333D8DF346B03E3F19BE7615E185330EA90B3303CCCD714F96BAC382CFD
5780AME Wizard Beta.exeC:\Users\admin\AppData\Local\Temp\AME\DiscUtils.Wim.dllexecutable
MD5:6DBB6E2A69CADD7AD06884B848880510
SHA256:2D290582F7CDD6D1C361DA310E3151AFFF0679E3EB2A44DA6C08A3EFDE00D083
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6472
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6472
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.139:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
2.23.209.148:443
—
Akamai International B.V.
GB
unknown
1176
svchost.exe
40.126.31.73:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1176
svchost.exe
20.190.159.75:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.48.23.139
  • 23.48.23.147
  • 23.48.23.138
  • 23.48.23.141
  • 23.48.23.146
  • 23.48.23.149
  • 23.48.23.158
  • 23.48.23.148
  • 23.48.23.156
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
archlinux.org
  • 95.217.163.246
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AME Wizard Beta.zip