File name:

Work With Dorks [DORK's Generator] By JohnDoe v.2.1.7z

Full analysis: https://app.any.run/tasks/942cd527-9e09-4fd7-ac46-fb64fb826f10
Verdict: Malicious activity
Analysis date: April 20, 2021, 11:07:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

AEA2810BF7C63D9434BCDC162E54210F

SHA1:

99F33A0E2DF3A8EBD18ECD3A8E6C1C9A533E2D1A

SHA256:

494C4460B6B5FC4C211CB3AEF45D18D1B21F83AB3E10A596F90A7F368FF83B6C

SSDEEP:

12288:0UwzXMFnHKFDglnAOC7K1kWJLJxideavA6JEH5mR4gx4kYLjPPMz49:0bKHKFDglnAOC7k/FCbK5T44kO7PMz49

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Work With Dork_v_2_1.exe (PID: 3252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2540)
      • Work With Dork_v_2_1.exe (PID: 3252)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2540)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3520)

  • INFO

    • Manual execution by user

      • chrome.exe (PID: 3520)
      • Work With Dork_v_2_1.exe (PID: 3252)
      • NOTEPAD.EXE (PID: 1536)

    • Reads the hosts file

      • chrome.exe (PID: 1860)
      • chrome.exe (PID: 3520)

    • Application launched itself

      • chrome.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
40
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe work with dork_v_2_1.exe notepad.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ea7a9d0,0x6ea7a9e0,0x6ea7a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16883391176057642671 --mojo-platform-channel-handle=3328 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4496595892504768167 --mojo-platform-channel-handle=3656 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
932"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=nacl-loader --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --service-request-channel-token=13847399026320788666 --mojo-platform-channel-handle=3224 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
3221225496
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
1448"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=1645393855685389549 --mojo-platform-channel-handle=3352 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1460"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5450984594097532771 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1536"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Results\Dorks-20.04.21-12.08.24.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=nacl-loader --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --service-request-channel-token=4918166647193095608 --mojo-platform-channel-handle=4364 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=1179538996918417170 --mojo-platform-channel-handle=3484 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1044,14333885174459687595,9575208918745832173,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4404679489896736493 --mojo-platform-channel-handle=3656 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 141
Read events
1 017
Write events
118
Delete events
6

Modification events

(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2540) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2540) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Work With Dorks [DORK's Generator] By JohnDoe v.2.1.7z
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2540) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3252) Work With Dork_v_2_1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
612
Text files
544
Unknown types
12

Dropped files

PID
Process
Filename
Type
3520chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-607EB64A-DC0.pma —
MD5:—
SHA256:—
3520chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3520chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\soap.xsdxml
MD5:A2213C9B642FE40C303DBECD10625284
SHA256:95B5F1FA631A18CE2599D49E6DA7E0AC9B698370DDA6EFB8F101DB9542622E7B
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\configuration91.svcinfoxml
MD5:3088E630D8B836EE5BACD9C867BC0AA3
SHA256:297ECA8F517040AAD7FDA7CDBE12C3B7A0FD124CAC376C724871A2E2EA9CBAC5
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\soap.wsdlxml
MD5:34E29BF87AB995613009041EE8EFBCCE
SHA256:E8FE1EDDB15B316C35A9D498C91081823212452226A42278B7A086CB2FC416CC
3520chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old —
MD5:—
SHA256:—
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\soap2.xsdxml
MD5:386E42D097C9828BBF74E907A04472C8
SHA256:DCED826BCB9B7BCC3F435A23F7E8BE179F8A70C781B53ACBF3E4605AEDBF699A
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\Reference.svcmapxml
MD5:09A372941AE01A4362EBA372D3C364B6
SHA256:B94123D35DDB03C9D71D6BA4D58477280F457D4D139C3BC41A4CFEAA95BD9F4A
2540WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2540.22814\Service References\TranslatorService\configuration.svcinfoxml
MD5:D935CB832F65D86D7C2A57D1794F5953
SHA256:42C0CA38FE255D41F4C1E5585C547D62C87FBE2E03BDDC17D16D42898819A32D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
43
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/nacl/mtproto_crypto.pexe?67
GB
binary
103 Kb
whitelisted
1860
chrome.exe
GET
302
216.58.212.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
519 b
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/js/lib/crypto_worker.js
GB
text
550 b
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/nacl/mtproto_crypto.nmf
GB
text
144 b
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/js/lib/bin_utils.js
GB
text
4.86 Kb
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/vendor/jsbn/jsbn_combined.js
GB
text
12.9 Kb
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/css/desktop.css
GB
text
11.3 Kb
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/vendor/cryptoJS/crypto.js
GB
text
14.5 Kb
whitelisted
1860
chrome.exe
GET
200
149.154.167.99:80
http://web.telegram.org/js/locales/en-us.json
GB
text
47.7 Kb
whitelisted
1860
chrome.exe
GET
301
149.154.167.99:80
http://telegram.me/_websync_?authed=0
GB
html
169 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1860
chrome.exe
142.250.185.99:443
www.google.com.ua
Google Inc.
US
whitelisted
1860
chrome.exe
172.217.18.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
1860
chrome.exe
216.58.212.141:443
accounts.google.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.186.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.186.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.185.206:443
clients2.google.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.186.129:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.186.163:443
www.gstatic.com
Google Inc.
US
whitelisted
1860
chrome.exe
142.250.185.238:443
ogs.google.com.ua
Google Inc.
US
whitelisted
1860
chrome.exe
149.154.167.99:80
web.telegram.org
Telegram Messenger LLP
GB
malicious

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.18.99
whitelisted
accounts.google.com
  • 216.58.212.141
shared
www.google.com.ua
  • 142.250.185.99
whitelisted
clients2.google.com
  • 142.250.185.206
whitelisted
fonts.googleapis.com
  • 142.250.186.170
whitelisted
www.gstatic.com
  • 142.250.186.163
whitelisted
fonts.gstatic.com
  • 142.250.186.99
whitelisted
clients2.googleusercontent.com
  • 142.250.186.129
whitelisted
redirector.gvt1.com
  • 216.58.212.174
whitelisted
apis.google.com
  • 142.250.186.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Work With Dorks [DORK's Generator] By JohnDoe v.2.1.7z