Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Use_50505_...rd.rar
windows10-2004-x64
Setup.exe
windows10-2004-x64
5langs/Croatian.ini
windows10-2004-x64
1langs/Danish.ini
windows10-2004-x64
1langs/English.ini
windows10-2004-x64
1langs/Finnish.ini
windows10-2004-x64
1langs/Hebrew.ini
windows10-2004-x64
1langs/Hungarian.ps1
windows10-2004-x64
1langs/Indonesian.ini
windows10-2004-x64
1langs/Japanese.ini
windows10-2004-x64
1langs/Kazakh.ini
windows10-2004-x64
1langs/Korean.ps1
windows10-2004-x64
1langs/Kurdish.ini
windows10-2004-x64
1langs/Norwegian.ini
windows10-2004-x64
1langs/SimpChinese.ini
windows10-2004-x64
1langs/Sinhala.ini
windows10-2004-x64
1langs/Slovak.ini
windows10-2004-x64
1langs/Swedish.ini
windows10-2004-x64
1langs/Thai.ini
windows10-2004-x64
1langs/TradChinese.ini
windows10-2004-x64
1langs/Ukrainian.ini
windows10-2004-x64
1langs/UyghurLatin.ini
windows10-2004-x64
1langs/Uzbek.ini
windows10-2004-x64
1langs/Vietnamese.ini
windows10-2004-x64
1Analysis
-
max time kernel
293s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2022, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
Use_50505_As_Passw0rd.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
langs/Croatian.ini
Resource
win10v2004-20220901-en
Behavioral task
behavioral4
Sample
langs/Danish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
langs/English.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral6
Sample
langs/Finnish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
langs/Hebrew.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
langs/Hungarian.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
langs/Indonesian.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral10
Sample
langs/Japanese.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
langs/Kazakh.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral12
Sample
langs/Korean.ps1
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
langs/Kurdish.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
langs/Norwegian.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
langs/SimpChinese.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
langs/Sinhala.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
langs/Slovak.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral18
Sample
langs/Swedish.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
langs/Thai.ini
Resource
win10v2004-20220901-en
Behavioral task
behavioral20
Sample
langs/TradChinese.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
langs/Ukrainian.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral22
Sample
langs/UyghurLatin.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
langs/Uzbek.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral24
Sample
langs/Vietnamese.ini
Resource
win10v2004-20221111-en
Errors
General
-
Target
Use_50505_As_Passw0rd.rar
-
Size
1.5MB
-
MD5
eb448a6e6f0ad5d08bac4ef38278aa36
-
SHA1
f3c92f9459f56e9db825721e25b8df076c37f0d1
-
SHA256
aa5889a3857f90179a40a1c61635c43f0d7133d18eab9c564d36d075e355de43
-
SHA512
a2e80829c78a204eff594ca01c413c3b65d3cebad772512e8e308f1d4623301511795670c385d0aee741a6d14bca6e5b0c8592bf3643288e381f9fd39bff1551
-
SSDEEP
24576:MbUtT8g9bPtJKf6cssILnoBvL5ov+wphRE7GBppg+NAPC0MdyYKF7H:MbcTtJt8fYsEoBD53dGBnpAPSdfU7H
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 1316 winrar-x64-611.exe 2368 uninstall.exe 6052 WinRAR.exe 1328 Setup.exe 4396 Setup.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe -
Loads dropped DLL 1 IoCs
pid Process 964 Process not Found -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1328 set thread context of 1124 1328 Setup.exe 138 PID 4396 set thread context of 5868 4396 Setup.exe 143 -
Drops file in Program Files directory 60 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240617531 winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 5436 1328 WerFault.exe 137 5648 4396 WerFault.exe 142 -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "240" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r06 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r02 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r03 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r20 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r07 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r12 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r08 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r17 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r11 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r13 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r05 uninstall.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\winrar-x64-611.exe:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5032 firefox.exe Token: SeDebugPrivilege 5032 firefox.exe Token: SeDebugPrivilege 5032 firefox.exe Token: SeDebugPrivilege 5032 firefox.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 5032 firefox.exe 5032 firefox.exe 5032 firefox.exe 5032 firefox.exe 6052 WinRAR.exe 6052 WinRAR.exe 6052 WinRAR.exe 6052 WinRAR.exe 6052 WinRAR.exe 6052 WinRAR.exe 6052 WinRAR.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 5032 firefox.exe 5032 firefox.exe 5032 firefox.exe -
Suspicious use of SetWindowsHookEx 62 IoCs
pid Process 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 4100 OpenWith.exe 5032 firefox.exe 5032 firefox.exe 5032 firefox.exe 5032 firefox.exe 1316 winrar-x64-611.exe 1316 winrar-x64-611.exe 1316 winrar-x64-611.exe 2368 uninstall.exe 6052 WinRAR.exe 6052 WinRAR.exe 3220 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 4372 wrote to memory of 5032 4372 firefox.exe 98 PID 5032 wrote to memory of 4672 5032 firefox.exe 99 PID 5032 wrote to memory of 4672 5032 firefox.exe 99 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 3508 5032 firefox.exe 100 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101 PID 5032 wrote to memory of 4984 5032 firefox.exe 101
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Use_50505_As_Passw0rd.rar1⤵PID:2700
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4100
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5032.0.732744442\895816326" -parentBuildID 20200403170909 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5032 "\\.\pipe\gecko-crash-server-pipe.5032" 1772 gpu3⤵PID:4672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5032.3.686162050\2024187109" -childID 1 -isForBrowser -prefsHandle 2464 -prefMapHandle 2484 -prefsLen 112 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5032 "\\.\pipe\gecko-crash-server-pipe.5032" 2352 tab3⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5032.13.272982226\205862025" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 6894 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 5032 "\\.\pipe\gecko-crash-server-pipe.5032" 3700 tab3⤵PID:4984
-
-
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1316 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3016
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\Use_50505_As_Passw0rd.rar"1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6052
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1328 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1124
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1328 -s 14122⤵
- Program crash
PID:5436
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 1328 -ip 13281⤵PID:5424
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4396 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:5868
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4396 -s 13802⤵
- Program crash
PID:5648
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 4396 -ip 43961⤵PID:5936
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3922055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD58933d6e810668af29d7ba8f1c3b2b9ff
SHA1760cbb236c4ca6e0003582aaefd72ff8b1c872aa
SHA256cd3ba458c88bdf8924ebb404c8505d627e6ac7aadc6e351562c1894019604fc7
SHA512344d737228483add83d5f2b31ae9582ca78013dc4be967f2cdafca24145970e3cb46d75373996150a3c9119ebc81ce9ac50e16696c17a4dea65c9571ef8e745e
-
Filesize
632KB
MD5650a771d005941c7a23926011d75ad8f
SHA184b346acd006f21d7ffb8d5ea5937ec0ee3daa4f
SHA256b28d116dd3066e7a3c9f0cc2f63d34a7189c9d78e869d1255c9dec59172a9d5f
SHA5124724bd81c26716f0ad59187c78fbb920fd8b251540e76c28d93e0afcce3ebe0e3e2b4605e9d444bbbc3e828ce11f2b73489404318ab11403eff94b42ef2c9bad
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
95KB
MD5d4c768c52ee077eb09bac094f4af8310
SHA1c56ae6b4464799fcdc87c5ff5a49ac1ad43482b1
SHA2568089dfbebdf2142c7f60f5c12098859417b3c997f0b24b696ccaa78a50f3726c
SHA5125b794b19b5ff10f7356a46f02204d0df3183037bc89d32e3f2c2978ea8f90ac6367fcb225b476cb7c8a3035d82ca1e328791271d3a58b40b9759d4b65e83f847
-
Filesize
314KB
MD581b236ef16aaa6a3936fd449b12b82a2
SHA1698acb3c862c7f3ecf94971e4276e531914e67bc
SHA256d37819e64ecb61709fcf3435eb9bed790f75163057e36fb94a3465ca353ccc5e
SHA512968fe20d6fe6879939297b8683da1520a1e0d2b9a5107451fca70b91802492e243976f56090c85eb9f38fca8f74134b8b6aa133ba2e2806d763c9f8516ace769
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
Filesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
Filesize
413.9MB
MD5af15e6423b24652d4a41311e26b96f28
SHA1585757a832d6e923ea3fc7051eb7412b62c34ad6
SHA2562727709123d4fd26090c227402a09e5779cec516d615d27e02faf1f346c9d895
SHA512bc666bd4fecb39590c199b933e7dfec345a01e5db44a8c8e636d7727378b6471a00e14f3c81d93bb82e22aea695bf71acae6f576e77b370f620dc290aed6075b
-
Filesize
413.9MB
MD5af15e6423b24652d4a41311e26b96f28
SHA1585757a832d6e923ea3fc7051eb7412b62c34ad6
SHA2562727709123d4fd26090c227402a09e5779cec516d615d27e02faf1f346c9d895
SHA512bc666bd4fecb39590c199b933e7dfec345a01e5db44a8c8e636d7727378b6471a00e14f3c81d93bb82e22aea695bf71acae6f576e77b370f620dc290aed6075b
-
Filesize
413.9MB
MD5af15e6423b24652d4a41311e26b96f28
SHA1585757a832d6e923ea3fc7051eb7412b62c34ad6
SHA2562727709123d4fd26090c227402a09e5779cec516d615d27e02faf1f346c9d895
SHA512bc666bd4fecb39590c199b933e7dfec345a01e5db44a8c8e636d7727378b6471a00e14f3c81d93bb82e22aea695bf71acae6f576e77b370f620dc290aed6075b
-
Filesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
Filesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54