File name:

GoogleChrome.zip

Full analysis: https://app.any.run/tasks/a29a369d-81a5-477f-af99-f38295b8c74b
Verdict: Malicious activity
Analysis date: May 16, 2025, 02:40:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
autoit
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

F5EDE370FE4D82B1A9AE28575929FE38

SHA1:

C6C4DDD5641774D0B937C911452E8C5BFBBBD502

SHA256:

EE0A4DBC127B93572D7416405883135EE5719BB3BCC71DF334891514DF03E29C

SSDEEP:

24576:MxEtYOwoidoy3SmTP6M1A+ug0Rpw/zO5K1K:MxEtYOwoidoy3SmTP6M1A+ug0Rpw/zOv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • rundll32.exe (PID: 2840)

    • Create files in the Startup directory

      • GoogleChrome.exe (PID: 3276)

    • Changes the autorun value in the registry

      • GoogleChrome.exe (PID: 3276)

    • Changes appearance of the Explorer extensions

      • GoogleChrome.exe (PID: 3276)

  • SUSPICIOUS

    • Reads the Internet Settings

      • GoogleChrome.exe (PID: 3276)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 3196)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • GoogleChrome.exe (PID: 3276)

    • Creates file in the systems drive root

      • GoogleChrome.exe (PID: 3276)

    • Executable content was dropped or overwritten

      • GoogleChrome.exe (PID: 3276)

    • Connects to unusual port

      • GoogleChrome.exe (PID: 3276)

    • There is functionality for taking screenshot (YARA)

      • GoogleChrome.exe (PID: 3276)

  • INFO

    • Manual execution by a user

      • GoogleChrome.exe (PID: 3684)
      • WinRAR.exe (PID: 2368)
      • explorer.exe (PID: 1800)
      • cmd.exe (PID: 3196)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2368)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2368)
      • GoogleChrome.exe (PID: 3276)

    • Reads mouse settings

      • GoogleChrome.exe (PID: 3684)
      • GoogleChrome.exe (PID: 3276)

    • Reads the machine GUID from the registry

      • GoogleChrome.exe (PID: 3684)
      • GoogleChrome.exe (PID: 3276)

    • Reads the computer name

      • GoogleChrome.exe (PID: 3684)
      • GoogleChrome.exe (PID: 3276)

    • Checks supported languages

      • GoogleChrome.exe (PID: 3684)
      • GoogleChrome.exe (PID: 3276)

    • Creates files in the program directory

      • GoogleChrome.exe (PID: 3276)

    • The process uses AutoIt

      • GoogleChrome.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:16 10:06:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: GoogleChrome/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winrar.exe explorer.exe no specs googlechrome.exe no specs cmd.exe googlechrome.exe netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1800"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2368"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\GoogleChrome.zip" "?\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2840"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\GoogleChrome.zip.xpiC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3196"C:\WINDOWS\system32\cmd.exe" /c start C:\GoogleChrome\GoogleChrome.exe C:\GoogleChrome\GoogleChrome.a3x & exitC:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3272"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\GoogleChrome\GoogleChrome.exe" "GoogleChrome.exe" ENABLEC:\Windows\System32\netsh.exe—GoogleChrome.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3276C:\GoogleChrome\GoogleChrome.exe C:\GoogleChrome\GoogleChrome.a3x C:\GoogleChrome\GoogleChrome.exe
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Version:
3, 3, 8, 1
Modules
Images
c:\googlechrome\googlechrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3684"C:\GoogleChrome\GoogleChrome.exe" C:\GoogleChrome\GoogleChrome.exe—explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
1
Version:
3, 3, 8, 1
Modules
Images
c:\googlechrome\googlechrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
Total events
10 622
Read events
10 460
Write events
147
Delete events
15

Modification events

(PID) Process:(2368) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:5
Value:
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:4
Value:
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:3
Value:
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Preferences
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:1
Value:
C:\Users\admin\Desktop\ext
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop\GoogleChrome
(PID) Process:(2368) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
Executable files
2
Suspicious files
30
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3276GoogleChrome.exeC:\GoogleChrome\WindowsUpdate.lnkbinary
MD5:AB787A9AA4630CCE04A25689D4E05641
SHA256:47CE7C41BE5911A6B64E80FE334091C6E6B9DF37926C88795A0D3A19C6AF37F9
3276GoogleChrome.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoogleUpdate.lnkbinary
MD5:B0E9A244F07D3C25147D246A26B982D4
SHA256:7EFAB979437CB91A012975905712603E8DEC3FE56A8A165D8D07D52982B92D64
3276GoogleChrome.exeC:\GoogleChrome\My Music.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\Users\Documents and Settings.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\$Recycle.Bin\$Recycle.Bin.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\$Recycle.Bin\My Music.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\Users\My Music.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\MozillaFirefox\My Music.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\MozillaFirefox\MozillaFirefox.lnkbinary
MD5:DD406FF3348EE5822C2241EEF535225C
SHA256:33DC34A37B4DD44641DB390364A648AF515FD93268E5CEEFE1D69278E5C006DF
3276GoogleChrome.exeC:\MozillaFirefox\GoogleChrome.exeexecutable
MD5:71D8F6D5DC35517275BC38EBCC815F9F
SHA256:FB73A819B37523126C7708A1D06F3B8825FA60C926154AB2D511BA668F49DC4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3276
GoogleChrome.exe
52.26.80.133:1212
dmad.info
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
dmad.info
  • 52.26.80.133
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GoogleChrome.zip