analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Full analysis: https://app.any.run/tasks/aa563970-ea61-4af1-b9b0-315b87192ff1
Verdict: Malicious activity
Threats:

Maze is ransomware — a malware type that encrypts the victim’s files and restores the data in exchange for a ransom payment. One of the most distinguishable features of Maze is that it is one of the first malware of the kind to publicly release stolen data.

Analysis date: April 01, 2023, 16:07:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
maze
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F83FB9CE6A83DA58B20685C1D7E1E546

SHA1:

01C459B549C1C2A68208D38D4BA5E36D29212A4F

SHA256:

E8A091A84DD2EA7EE429135FF48E9F48F7787637CCB79F6C3EB42F34588BC684

SSDEEP:

12288:v6l/7FpnaeoQbRLBYdunMCayql4YcQD+AgJbAWgjbgpQ:CDna43YAKl4Yci+AggEpQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Deletes shadow copies

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Maze is detected

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Steals credentials from Web Browsers

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Modifies files in the Chrome extension folder

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Actions looks like stealing of personal data

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
  • SUSPICIOUS

    • Connects to the server without a host name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Uses WMIC.EXE to obtain shadow copy information

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Reads the Internet Settings

      • WMIC.exe (PID: 3848)
  • INFO

    • Reads Environment values

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • The process checks LSA protection

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
      • WMIC.exe (PID: 3848)
    • Reads product name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Reads the machine GUID from the registry

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Checks supported languages

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Reads the computer name

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Creates files in the program directory

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
    • Creates files or folders in the user directory

      • e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x9fa7
UninitializedDataSize: -
InitializedDataSize: 409088
CodeSize: 82432
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2019:05:27 20:03:22+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-May-2019 20:03:22

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 27-May-2019 20:03:22
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00014043
0x00014200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62596
.rdata
0x00016000
0x000065BE
0x00006600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.76406
.data
0x0001D000
0x0005C240
0x0005A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99076
.reloc
0x0007A000
0x00001214
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.22098

Imports

KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MAZE e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Users\admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe" C:\Users\admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
3848"C:\l\..\Windows\rqfhg\..\system32\xj\bpudb\..\..\wbem\wbud\..\wmic.exe" shadowcopy deleteC:\Windows\System32\wbem\WMIC.exee8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
542
Read events
542
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2 588
Text files
830
Unknown types
82

Dropped files

PID
Process
Filename
Type
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\Adobe\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\MSOCache\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestampbinary
MD5:4E57430B3BB288C3633392CB8C33772F
SHA256:360EE6DF848CC0E4E51C4673ACFE0ACAD8FD16CC2994CBC9516763D33D22A093
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\AppData\Local\VirtualStore\DECRYPT-FILES.htmlhtml
MD5:1C9DADDF1FDC7050C35D83C4AEBC0C13
SHA256:2B3B99C6D1D2739C4983E77FD35600506BC75F2366C63E1E0FC1BF88852BD1A5
2696e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.hdr2binary
MD5:4E57430B3BB288C3633392CB8C33772F
SHA256:360EE6DF848CC0E4E51C4673ACFE0ACAD8FD16CC2994CBC9516763D33D22A093
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2696
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
POST
92.63.8.47:80
http://92.63.8.47/webauth/qablp.jsp
TR
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
92.63.8.47:80
Netonline Bilisim Sirketi LTD
CY
malicious

DNS requests

No data

Threats

No threats detected
No debug info