File name:

TSP Dork generator v15.0_pass_1.zip

Full analysis: https://app.any.run/tasks/e4b5f248-3cbb-4571-935d-7ecc7c744b30
Verdict: Malicious activity
Analysis date: October 18, 2019, 09:34:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

BBDB111C57286CC5FA2DD8863BCA7C1E

SHA1:

F8AC8897EBF9480593A41E711FD558A2C67A22DC

SHA256:

9D8B6377939A5AE1B3226581CCAA06CED537B060EE5943234619AE19DA757BFA

SSDEEP:

12288:GSTb1W2qKc//zaD+WiFyYpTanPXQaCu2ExlAdE:GSf1qdzaDZ+HT0KXdE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TempSetup.exe (PID: 3852)
      • ~TSP_Dork_generator_v_15_0.exe (PID: 3624)
      • TempSetup.exe (PID: 4064)
      • TSP Dork generator v.15.0.exe (PID: 2056)
      • svchost.exe (PID: 3688)
      • explorer.exe (PID: 2488)
      • taskhost.exe (PID: 3652)

    • Changes the autorun value in the registry

      • TempSetup.exe (PID: 4064)
      • svchost.exe (PID: 3688)
      • explorer.exe (PID: 2488)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TSP Dork generator v.15.0.exe (PID: 2056)
      • TempSetup.exe (PID: 4064)
      • svchost.exe (PID: 3688)
      • vbc.exe (PID: 2284)

    • Creates files in the user directory

      • TempSetup.exe (PID: 4064)
      • svchost.exe (PID: 3688)
      • vbc.exe (PID: 2284)

    • Creates executable files which already exist in Windows

      • TempSetup.exe (PID: 4064)
      • svchost.exe (PID: 3688)

    • Executes scripts

      • explorer.exe (PID: 2488)

  • INFO

    • Manual execution by user

      • TSP Dork generator v.15.0.exe (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:09:25 07:49:10
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Settings/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs tsp dork generator v.15.0.exe tempsetup.exe no specs tempsetup.exe ~tsp_dork_generator_v_15_0.exe svchost.exe explorer.exe vbc.exe cvtres.exe no specs taskhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1516"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TSP Dork generator v15.0_pass_1.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2056"C:\Users\admin\Desktop\TSP Dork generator v.15.0.exe" C:\Users\admin\Desktop\TSP Dork generator v.15.0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TSP Dork generator Gold Edition
Exit code:
0
Version:
15.0
Modules
Images
c:\users\admin\desktop\tsp dork generator v.15.0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2060C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES3501.tmp" "C:\Users\admin\AppData\Local\Temp\vbc34F0.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2284"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\anf1nifd.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2488"C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.exe" C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.exe
svchost.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
4294967295
Version:
6.1.7600.8900
Modules
Images
c:\users\admin\appdata\roaming\intel corporation\intel(r) common user interface\8.1.1.7900\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3624"C:\Users\admin\Desktop\~TSP_Dork_generator_v_15_0.exe" C:\Users\admin\Desktop\~TSP_Dork_generator_v_15_0.exe
TSP Dork generator v.15.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
TSP Dork generator Gold Edition
Exit code:
0
Version:
15.0
Modules
Images
c:\users\admin\desktop\~tsp_dork_generator_v_15_0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3652"C:\Users\admin\AppData\Roaming\Microsoft\Windows\taskhost.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\taskhost.exe
explorer.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
8.15.1.3308
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\taskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3688"C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\svchost.exe" C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\svchost.exe
TempSetup.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
4294967295
Version:
8.1.1.7900
Modules
Images
c:\users\admin\appdata\roaming\intel corporation\intel(r) common user interface\8.1.1.7900\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3852"C:\Users\admin\AppData\Local\TempSetup.exe" C:\Users\admin\AppData\Local\TempSetup.exe—TSP Dork generator v.15.0.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
4294967295
Version:
8.1.1.7900
Modules
Images
c:\users\admin\appdata\local\tempsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4064"C:\Users\admin\AppData\Local\TempSetup.exe" C:\Users\admin\AppData\Local\TempSetup.exe
TSP Dork generator v.15.0.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
4294967295
Version:
8.1.1.7900
Modules
Images
c:\users\admin\appdata\local\tempsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 004
Read events
1 938
Write events
66
Delete events
0

Modification events

(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1516) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\TSP Dork generator v15.0_pass_1.zip
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1516) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
5
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\Settings\language.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\TSP Dork generator v.15.0.exe —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\domainextentions\preset1.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\domainextentions\preset2.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\domainextentions\preset3.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\domainextentions\preset4.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\keywords\preset1.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\keywords\preset2.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\keywords\preset3.txt —
MD5:—
SHA256:—
1516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1516.29763\presets\keywords\preset4.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
31
DNS requests
3
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3688
svchost.exe
GET
200
209.99.16.94:80
http://www.anandpen.com/wp-includes/images/media/1/explorer.zip
US
compressed
76.1 Kb
malicious
3688
svchost.exe
GET
200
160.153.51.197:80
http://capeturk.com/1/explorer.txt
US
text
84 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3688
svchost.exe
160.153.51.197:80
capeturk.com
GoDaddy.com, LLC
US
unknown
3688
svchost.exe
209.99.16.94:80
www.anandpen.com
PDR
US
malicious
3652
taskhost.exe
208.115.109.117:2222
blog.capeturk.com
Wowrack.com
US
unknown

DNS requests

Domain
IP
Reputation
capeturk.com
  • 160.153.51.197
whitelisted
www.anandpen.com
  • 209.99.16.94
malicious
blog.capeturk.com
  • 208.115.109.117
malicious

Threats

PID
Process
Class
Message
3688
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.DownLoader22.55152 (BackDoor.RevetRat)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TSP Dork generator v15.0_pass_1.zip