File name:

Google Dork Searcher V1.0 [Crax.Pro].rar

Full analysis: https://app.any.run/tasks/e8c641df-1a45-4dfd-8b42-620f1481d9d2
Verdict: Malicious activity
Analysis date: February 03, 2024, 10:50:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

45D03DDFB3E1B93B0C3D13C19B0FFC28

SHA1:

F6CA50E153CA6F74495D12E81807328C3D2892B7

SHA256:

ED7F23B7007D348EC3A8FD40308560BB484E7C1E10F9D557643D8E60C60BCD7C

SSDEEP:

98304:mndW3H0pKDgPN8TKodWB7xDfQmsdiZ+ZhrUsRBpagtwwgo8eEigEgg6lHKcg6wJK:SIMJw6zIY/t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Launcher.exe (PID: 2556)

    • Adds path to the Windows Defender exclusion list

      • Launcher.exe (PID: 2556)

    • Drops the executable file immediately after the start

      • Launcher.exe (PID: 2556)
      • WinRAR.exe (PID: 1392)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Launcher.exe (PID: 2556)
      • powershell.exe (PID: 3020)
      • Windows Services.exe (PID: 3372)
      • Google Dork Searcher v1.0.exe (PID: 2416)

    • Script adds exclusion path to Windows Defender

      • Launcher.exe (PID: 2556)

    • The process creates files with name similar to system file names

      • Launcher.exe (PID: 2556)

    • Starts POWERSHELL.EXE for commands execution

      • Launcher.exe (PID: 2556)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3020)

    • Executable content was dropped or overwritten

      • Launcher.exe (PID: 2556)

  • INFO

    • Checks supported languages

      • Google Dork Searcher v1.0.exe (PID: 2416)
      • Launcher.exe (PID: 2556)
      • Windows Services.exe (PID: 3372)
      • Secure System Shell.exe (PID: 2612)
      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 3640)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 2536)
      • Runtime Explorer.exe (PID: 4016)
      • Runtime Explorer.exe (PID: 2912)
      • Runtime Explorer.exe (PID: 2524)

    • Reads the computer name

      • Launcher.exe (PID: 2556)
      • Google Dork Searcher v1.0.exe (PID: 2416)
      • Secure System Shell.exe (PID: 2612)
      • Windows Services.exe (PID: 3372)

    • Reads the machine GUID from the registry

      • Launcher.exe (PID: 2556)
      • Windows Services.exe (PID: 3372)
      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 3640)
      • Secure System Shell.exe (PID: 2612)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 4016)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 2536)
      • Runtime Explorer.exe (PID: 2524)
      • Runtime Explorer.exe (PID: 2912)
      • Google Dork Searcher v1.0.exe (PID: 2416)

    • Creates files or folders in the user directory

      • Launcher.exe (PID: 2556)

    • Create files in a temporary directory

      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 3640)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 4016)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 2524)
      • Runtime Explorer.exe (PID: 2912)
      • Runtime Explorer.exe (PID: 2536)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe google dork searcher v1.0.exe no specs launcher.exe powershell.exe no specs windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1392"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Google Dork Searcher V1.0 [Crax.Pro].rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2416"C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1392.46042\google dork searcher v1.0 [crax.pro]\google dork searcher v1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2524"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2536"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2556"C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Launcher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Launcher.exe
Google Dork Searcher v1.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1392.46042\google dork searcher v1.0 [crax.pro]\pnpclean\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2612"C:\Windows\IMF\Secure System Shell.exe" C:\Windows\IMF\Secure System Shell.exe—Windows Services.exe
User:
admin
Integrity Level:
HIGH
Description:
Secure System Shell
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\imf\secure system shell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2912"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3020"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3372"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}C:\Windows\IMF\Windows Services.exe—Launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\imf\windows services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3480"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
3 431
Read events
3 370
Write events
61
Delete events
0

Modification events

(PID) Process:(1392) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
10
Suspicious files
15
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\LICENCE.datcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exeexecutable
MD5:8FA16A45E2A72FC7ABCA44A4B41E95D6
SHA256:8AD6313D040F9D4188034BB80C5C5FD41A6E3E0142682347B557060FDDC8A1FD
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Put_your_Dorks_Here.txttext
MD5:99B475CDF07BE35F82F3F9E0D3E78704
SHA256:0896E90C9D38F861BB878F27A4FE141C5A6147414B7427E8DF7BFC76B8CB45CA
3020powershell.exeC:\Users\admin\AppData\Local\Temp\r5lef5uy.nd1.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\RuriLib.exeexecutable
MD5:C715E67E7CB9AFB0752C219733742657
SHA256:9085CED212F5EC31BD648F397B57B1D3202DB0EF990D4ECAA31D4A9A21633E5C
3020powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Ionic.Zip.dllexecutable
MD5:F6933BF7CEE0FD6C80CDF207FF15A523
SHA256:17BB0C9BE45289A2BE56A5F5A68EC9891D7792B886E0054BC86D57FE84D01C89
3020powershell.exeC:\Users\admin\AppData\Local\Temp\fhwll51a.4u5.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2556Launcher.exeC:\Windows\IMF\LICENCE.zipcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
2556Launcher.exeC:\Windows\IMF\LICENCE.datcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Google Dork Searcher V1.0 [Crax.Pro].rar