Analysis
-
max time kernel
145s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 00:14
Static task
static1
Behavioral task
behavioral1
Sample
winrar-x64-611.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
winrar-x64-611.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
winrar-x64-611.exe
-
Size
3.3MB
-
MD5
8a6217d94e1bcbabdd1dfcdcaa83d1b3
-
SHA1
99b81b01f277540f38ea3e96c9c6dc2a57dfeb92
-
SHA256
3023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
-
SHA512
a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
SSDEEP
98304:mZjOBfKqY3fhMBexKTvsCHBviBh2GB8y0mb5:mZZ7fhMB2ovFNiKGhJ
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 3 IoCs
Processes:
winrar-x64-611.exedescription ioc process File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_7129604 winrar-x64-611.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe -
Processes:
winrar-x64-611.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main winrar-x64-611.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
winrar-x64-611.exepid process 1544 winrar-x64-611.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
winrar-x64-611.exepid process 1544 winrar-x64-611.exe 1544 winrar-x64-611.exe