Resubmissions
01/02/2023, 23:44
230201-3q4s2sdd64 801/02/2023, 23:23
230201-3dk56sdc45 801/02/2023, 22:30
230201-2eybfseg3x 10Analysis
-
max time kernel
61s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2023, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
_.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
mmercado-ve73580jov.vbs
Resource
win10v2004-20221111-en
General
-
Target
_.exe
-
Size
3.4MB
-
MD5
73414a9b8498d43b9a195dac57871203
-
SHA1
3e59209a7855955c7ca7500adf43e9c17b9a4568
-
SHA256
4b153e952d823b2126d3efba4f8a1353642645e00be93ab49f603d9e924c800e
-
SHA512
cb7dbfef452ff3da6207afea59ba77f0790756ea87a690d08cad32f27feaa78aa47196eeb9e7ae78ac3690bdf2195fca06a5b96c4614ca350803d70e743e5017
-
SSDEEP
98304:WSBOBfKt6BT9VQKKJnlCZtnCowXyrmt8p/oFhB2MLIz4:WS/t63VlgkWcA8p/oPUML04
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe -
Executes dropped EXE 1 IoCs
pid Process 4456 uninstall.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation _.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WinRAR\RarFiles.lst _.exe File created C:\Program Files\WinRAR\WinRAR.exe _.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX _.exe File created C:\Program Files\WinRAR\WhatsNew.txt _.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst _.exe File created C:\Program Files\WinRAR\Rar.exe _.exe File created C:\Program Files\WinRAR\WinCon.SFX _.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX _.exe File created C:\Program Files\WinRAR\Rar.txt _.exe File opened for modification C:\Program Files\WinRAR\Rar.exe _.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe _.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX _.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst _.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png _.exe File created C:\Program Files\WinRAR\Order.htm _.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll _.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240559656 _.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe _.exe File created C:\Program Files\WinRAR\RarExtPackage.msix _.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png _.exe File created C:\Program Files\WinRAR\Descript.ion _.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt _.exe File created C:\Program Files\WinRAR\Default64.SFX _.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX _.exe File created C:\Program Files\WinRAR\Zip64.SFX _.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt _.exe File opened for modification C:\Program Files\WinRAR\Order.htm _.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe _.exe File created C:\Program Files\WinRAR\UnRAR.exe _.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll _.exe File opened for modification C:\Program Files\WinRAR\Resources.pri _.exe File opened for modification C:\Program Files\WinRAR _.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe _.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll _.exe File created C:\Program Files\WinRAR\RarExt.dll _.exe File created C:\Program Files\WinRAR\Default.SFX _.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX _.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png _.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png _.exe File opened for modification C:\Program Files\WinRAR\Rar.txt _.exe File opened for modification C:\Program Files\WinRAR\Default.SFX _.exe File created C:\Program Files\WinRAR\Uninstall.lst _.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe _.exe File created C:\Program Files\WinRAR\WinCon64.SFX _.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png _.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm _.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\License.txt _.exe File opened for modification C:\Program Files\WinRAR\License.txt _.exe File opened for modification C:\Program Files\WinRAR\Descript.ion _.exe File created C:\Program Files\WinRAR\ReadMe.txt _.exe File created C:\Program Files\WinRAR\Uninstall.exe _.exe File created C:\Program Files\WinRAR\7zxa.dll _.exe File created C:\Program Files\WinRAR\Zip.SFX _.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\RarExt32.dll _.exe File created C:\Program Files\WinRAR\Resources.pri _.exe File created C:\Program Files\WinRAR\WinRAR.chm _.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix _.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png _.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r05 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r16 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r06 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r14 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r23 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r28 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r20 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r24 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r25 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2504 _.exe 2504 _.exe 4456 uninstall.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2504 wrote to memory of 4456 2504 _.exe 87 PID 2504 wrote to memory of 4456 2504 _.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\_.exe"C:\Users\Admin\AppData\Local\Temp\_.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4456
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2456
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5e8943094a7a6e3a6767e8d412fdbc8c3
SHA17e7eac16f0741a747639a131cf8e93e63c7e9d7c
SHA25635c7deb1cf472f4d695ab0def305234629440236a8e9422fa8860c362ffe35bd
SHA512dda86c6f7ad30bf7dfb7d2d8584f0956018b7425837129d6c9de3c126a9ec48bda8b761bd6084031f0daaa22393af901820a9f2cce1a049944db27705da1209b
-
Filesize
437KB
MD54b666387a3c9dcff1a35f928003906f8
SHA1afdcb15eb059fa09acc0f0ac7745a5c9b6325cf6
SHA256882dc7d4df95d06de571b475f50472639d62298b7da2bb78cd35f462d815fe92
SHA51260c26cea6eff640b116e98f8e8a6d6de00e6fe6cc379768574c5a8e1df95a6cf6bf37e2f56d040cca537a3406e2af05888a63c5b167ca25b16518808c3a5574e
-
Filesize
102KB
MD5009a59803c14130cfb6ef5b1fc8b2bce
SHA11842d01ecd0bfaf5db6c89d17458ba9cac8d0cf1
SHA25686491ffa4415b525dd4f51f3806b5217c5fdbaeee83ac313e28ed342bde83ff5
SHA512a67aa1d6ccfce38314d488fa20469b05f84cf5cb5bdd089b7c28349b64bc359954fccfea7eb574eb3eeb7eec4b6d7f07f334c6be96d14ea301b7706d168ed3d3
-
Filesize
317KB
MD579f52d2a3c76f7402de3e30b2dc9bc7e
SHA1bb15a3289e308295891b3078190e8d797a52acf2
SHA2564e4db98a555a3821e911bc35c301fd4dab8530cf9fede6f6c9439e212919abda
SHA51273b09d5db6ca8587ec8f5b7a0bd711a9225561116d90ae7609442bd388110eebb075a5862bb1abae54f8c32cb880e27d741dbecdba2cb9b2c10c5ef7b1a2685b
-
Filesize
2.4MB
MD5f01b85893ccecbb9020d065e47e046aa
SHA1237311f4c143f74758a8ef6aeeeff0b9dcfe1434
SHA256821588b7db1e9a4ddcf4a53435334370e57cd4663a6f4f2aa570e5850432ca42
SHA5125f821880075570b6f1fa5bdf231d46b4e64dd44e2b122cd7c6ef6ed007e9bf23e33e1abef6eef1ef3a9eb63940bc8eb63cc0daa5a2e85062dbb4f2292d59c835
-
Filesize
437KB
MD54b666387a3c9dcff1a35f928003906f8
SHA1afdcb15eb059fa09acc0f0ac7745a5c9b6325cf6
SHA256882dc7d4df95d06de571b475f50472639d62298b7da2bb78cd35f462d815fe92
SHA51260c26cea6eff640b116e98f8e8a6d6de00e6fe6cc379768574c5a8e1df95a6cf6bf37e2f56d040cca537a3406e2af05888a63c5b167ca25b16518808c3a5574e