File name:

Google Dork Searcher V1.0 [Crax.Pro].rar

Full analysis: https://app.any.run/tasks/e8c641df-1a45-4dfd-8b42-620f1481d9d2
Verdict: Malicious activity
Analysis date: February 03, 2024, 10:50:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

45D03DDFB3E1B93B0C3D13C19B0FFC28

SHA1:

F6CA50E153CA6F74495D12E81807328C3D2892B7

SHA256:

ED7F23B7007D348EC3A8FD40308560BB484E7C1E10F9D557643D8E60C60BCD7C

SSDEEP:

98304:mndW3H0pKDgPN8TKodWB7xDfQmsdiZ+ZhrUsRBpagtwwgo8eEigEgg6lHKcg6wJK:SIMJw6zIY/t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Launcher.exe (PID: 2556)

    • Drops the executable file immediately after the start

      • Launcher.exe (PID: 2556)
      • WinRAR.exe (PID: 1392)

    • Create files in the Startup directory

      • Launcher.exe (PID: 2556)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Launcher.exe (PID: 2556)

    • Script adds exclusion path to Windows Defender

      • Launcher.exe (PID: 2556)

    • Reads the Internet Settings

      • Launcher.exe (PID: 2556)
      • powershell.exe (PID: 3020)
      • Google Dork Searcher v1.0.exe (PID: 2416)
      • Windows Services.exe (PID: 3372)

    • Executable content was dropped or overwritten

      • Launcher.exe (PID: 2556)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3020)

    • Starts POWERSHELL.EXE for commands execution

      • Launcher.exe (PID: 2556)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1392)

    • Checks supported languages

      • Google Dork Searcher v1.0.exe (PID: 2416)
      • Launcher.exe (PID: 2556)
      • Windows Services.exe (PID: 3372)
      • Secure System Shell.exe (PID: 2612)
      • Runtime Explorer.exe (PID: 3640)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 4016)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 2912)
      • Runtime Explorer.exe (PID: 2536)
      • Runtime Explorer.exe (PID: 2524)

    • Reads the machine GUID from the registry

      • Google Dork Searcher v1.0.exe (PID: 2416)
      • Launcher.exe (PID: 2556)
      • Runtime Explorer.exe (PID: 3640)
      • Secure System Shell.exe (PID: 2612)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 2912)
      • Runtime Explorer.exe (PID: 2536)
      • Runtime Explorer.exe (PID: 2524)
      • Windows Services.exe (PID: 3372)
      • Runtime Explorer.exe (PID: 4016)

    • Creates files or folders in the user directory

      • Launcher.exe (PID: 2556)

    • Reads the computer name

      • Launcher.exe (PID: 2556)
      • Windows Services.exe (PID: 3372)
      • Secure System Shell.exe (PID: 2612)
      • Google Dork Searcher v1.0.exe (PID: 2416)

    • Create files in a temporary directory

      • Runtime Explorer.exe (PID: 3888)
      • Runtime Explorer.exe (PID: 3480)
      • Runtime Explorer.exe (PID: 4016)
      • Runtime Explorer.exe (PID: 3876)
      • Runtime Explorer.exe (PID: 3872)
      • Runtime Explorer.exe (PID: 2912)
      • Runtime Explorer.exe (PID: 2536)
      • Runtime Explorer.exe (PID: 2524)
      • Runtime Explorer.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe google dork searcher v1.0.exe no specs launcher.exe powershell.exe no specs windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1392"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Google Dork Searcher V1.0 [Crax.Pro].rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2416"C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1392.46042\google dork searcher v1.0 [crax.pro]\google dork searcher v1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2524"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2536"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2556"C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Launcher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Launcher.exe
Google Dork Searcher v1.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1392.46042\google dork searcher v1.0 [crax.pro]\pnpclean\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2612"C:\Windows\IMF\Secure System Shell.exe" C:\Windows\IMF\Secure System Shell.exe—Windows Services.exe
User:
admin
Integrity Level:
HIGH
Description:
Secure System Shell
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\imf\secure system shell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2912"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3020"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3372"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}C:\Windows\IMF\Windows Services.exe—Launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\imf\windows services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3480"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
3 431
Read events
3 370
Write events
61
Delete events
0

Modification events

(PID) Process:(1392) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
10
Suspicious files
15
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Launcher.exeexecutable
MD5:C6D4C881112022EB30725978ECD7C6EC
SHA256:0D87B9B141A592711C52E7409EC64DE3AB296CDDC890BE761D9AF57CEA381B32
3020powershell.exeC:\Users\admin\AppData\Local\Temp\r5lef5uy.nd1.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2556Launcher.exeC:\Windows\IMF\Runtime Explorer.exeexecutable
MD5:D42C2456EA9DE66A75A29DEA464A4E4D
SHA256:907E7F7E2EE47C955CF315747AB913B591E9046F51C0F3BA9A6EEF696346198E
3020powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
3888Runtime Explorer.exeC:\Users\admin\AppData\Local\Temp\~DFDD6AEB65074A200E.TMPbinary
MD5:CD442CFD68BE79A859C9F9639FD1636A
SHA256:3E72BD2CD30863948625E2A33846CB41B1D5A5C42D19AB9A0E20238008CBFC67
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\Google Dork Searcher v1.0.exeexecutable
MD5:8FA16A45E2A72FC7ABCA44A4B41E95D6
SHA256:8AD6313D040F9D4188034BB80C5C5FD41A6E3E0142682347B557060FDDC8A1FD
2556Launcher.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnkbinary
MD5:00014432158B443ADA05F20AC037DDA7
SHA256:39BD65F75BE0A773F1BF606B0A31AC8E22DE8EBD8B9AC7109821FD421856B5F9
2556Launcher.exeC:\Windows\IMF\Secure System Shell.exe.tmpexecutable
MD5:7D0C7359E5B2DAA5665D01AFDC98CC00
SHA256:F1ABD5AB03189E82971513E6CA04BD372FCF234D670079888F01CF4ADDD49809
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\LICENCE.datcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
1392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1392.46042\Google Dork Searcher V1.0 [Crax.Pro]\pnpclean\Ionic.Zip.dllexecutable
MD5:F6933BF7CEE0FD6C80CDF207FF15A523
SHA256:17BB0C9BE45289A2BE56A5F5A68EC9891D7792B886E0054BC86D57FE84D01C89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Google Dork Searcher V1.0 [Crax.Pro].rar