37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796

Resubmissions

08-03-2023 11:26

230308-nj8q4aga62 7

08-03-2023 11:23

230308-nhc8ssfd9t 1

Analysis

max time kernel
55s
max time network
58s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe
Size

2.4MB
MD5

73d88f68025bbc504706c743bfd29855
SHA1

86ba9c56c687f7c3d0c6da45b0f1aaedde849e5c
SHA256

37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796
SHA512

7e96d201ed4d6e27d77dffb85062c99c259bc03d037b5fb706e2d380008e29accde494cf1c8c79ad6f6000f9b0b8758b5a301c6a9d8ebf64d7c6aa111adffa91
SSDEEP

49152:5uWXP3qw4WxjuUIom2f7ADTD9Jf6tmlZA6wDst9szdkuXwvPwy4GiiizFE3am:5uIvzjmom2TkTn6tqClDqszdbB6am

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1136	Launch WinRAR.exe
912	WinRAR.exe

Loads dropped DLL 16 IoCs

pid	Process
1136	Launch WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe
912	WinRAR.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	Launch WinRAR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\New folder\\WinRAR Unplugged\\WinRAR.exe\" \"%1\""	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iso	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\WinRAR.exe\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\New folder\\WinRAR Unplugged\\WinRAR.exe\" \"%1\""	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r25	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\WinRAR.exe\shell\open\command	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\New folder\\WinRAR Unplugged\\WinRAR.exe\" \"%1\""	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r19	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\WinRAR.exe\shell\open	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Users\\Admin\\Desktop\\New folder\\WinRAR Unplugged\\rarnew.dat"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR"	Launch WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	Launch WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	Launch WinRAR.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1724	37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1664	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1664	AUDIODG.EXE
Token: 33	1664	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1664	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	Launch WinRAR.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1136	Launch WinRAR.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe
1724	37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33
PID 1136 wrote to memory of 912	1136	Launch WinRAR.exe	33

C:\Users\Admin\AppData\Local\Temp\37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe
"C:\Users\Admin\AppData\Local\Temp\37d151ab9fd61c5bfad26990c839499aa2c7eb9cd84f5effacacb4cfed425796.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x574
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Launch WinRAR.exe
"C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Launch WinRAR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\WinRAR.exe
  "C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wru3reg.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\7z.fmt

Filesize
79KB

MD5
995e32816fd7c6ddbf492f87adc8c145

SHA1
211f9d471eb8fb0da651286316e8d15bef20b736

SHA256
df53923a727944d05bc2f6ffd20ed02ea5f9cedb7a8f497191df3b7a15b35072

SHA512
cdde7b4c4957b14c7937aa50478284eba93ac0036e47c797979e0787a41d55f826862b0a670251e0f3cd103a2f4ccb3bde982dffefcf5816285c299c482ef6a9

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\ace.fmt

Filesize
81KB

MD5
2d3fa60d3e7579ac9e45ec1db7f27057

SHA1
f6ab555168e1a2e1a9202158300fff57d3c9b7af

SHA256
36dafa540b5fc464638e2a98189b12813783e7567dd7b2d54ff9475251298ad9

SHA512
d656e986cf26a17ac130324e0ad649f90a615a057a304121d3aba86bca9e709150410cbd33e2e205799d8ba35eb77445ddab62a3811241ebe22b910a6344f027

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\arj.fmt

Filesize
69KB

MD5
456603cb634faa56f0603ba758475246

SHA1
028188e94749a5e1e8a7dcd09389de5697323ed7

SHA256
fad9d84b1046ba83cc328729f527a2ec0b74ce367690d2324f04e665908429df

SHA512
670be16b68ac0675849195dd06748b63acd37e3791425f133c11807747d988e9d59c1aabe95708684917a9352089d4a299b720b6f530b0330825410fb4305c89

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\bz2.fmt

Filesize
87KB

MD5
30ddd664b909af20ae8ceea59c8ea60e

SHA1
34a4a18e3cb0ed775d3192678cd348a9fec58b92

SHA256
770099458f9298b8a22c1ca44b9f7e635ca272d74e2387b7d58829632723be9f

SHA512
37bb0cbd720c8fa64e20f2c0e1473244812540d24d2e6bee564c2e44a83cbe43efe29380482b28f1933c962e61aea4f90efe730537cf468ab9db9d9c041fbe20

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\cab.fmt

Filesize
63KB

MD5
b59abd0918120b43e866b17100d29674

SHA1
88db8f935a245473db4d5452c4da7576c07eb00c

SHA256
b7a35b47040be0cb534385ad11975c7a1957366893466c97f6bbe8def597c281

SHA512
55bc50613da4294c1170da97140be5998d709ccdeee1f4d2919dba3fe52a9dc4dbe3f9b584944a676f42629be7029a0bc82100e2c19a5b25a52578460c93e743

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\gz.fmt

Filesize
79KB

MD5
01cfaeed15f6a6c47846807ff6f6602f

SHA1
0cc885e54d5dd031291e37663e918b05ee50c518

SHA256
3cec3960959f252c0c97ea0a63994af4a3e4a2ee9e550a0f91543fd1eb164e28

SHA512
f22f5b75f4e2583d7fe2e20656f285f6119770dc76a7bfb0f5728ae757946ff648d164bbff8e6f979e3c941638c71e6a453457dfc86ebf259cae546dad7c8fc5

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\iso.fmt

Filesize
80KB

MD5
d6bf07ce6ef4196887a97be29cd749cf

SHA1
7419f1ac00b15754edc1679cddd9bef168015672

SHA256
a74c9fa10a7f137d1a66a929e09c2fee31e508a6f18af8d174d7a10924e08b61

SHA512
0e9173cc308be10dc87aa0462f22edf1bc058034f01acfb60512c10c63cea0055ad1c8b359177841e62d6e0420bc49cd5c50179ed4d5c712430e91e297344e49

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\lzh.fmt

Filesize
80KB

MD5
d2b491c5541538371e4ceb49209ac73c

SHA1
66dfccb9dd10ef0929b39da082807a7a51eb8dfc

SHA256
fba57b8318f5212d94f323f3df01be9d7db0adb32fdc119910d71f315fae8b82

SHA512
a0cf3fcf9606749ffd786d7a375761d3abd889abc9e355a33e125a203734b2abd8ecf4d2032a0902ad0bdf7a9759e7ce555525b39c05ff3ac3454857d09d128d

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\tar.fmt

Filesize
68KB

MD5
692e9335b118351035defdc7556b4d55

SHA1
874f38dc0b75cc37ecde0b601e198a77716c267f

SHA256
454bb9bc8bcc4065e0e9e17c2ffaa250e1b3b46d1aa97243a5ecdf31ccfbadf0

SHA512
a0445950b77e373f5faeed146b6d2cf37a4365a547699bd9011736d34f5d21f67ba9f35c1be28815e3ac973a4550fa651b8a11d2f0066baa7d59582edb47c66a

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\uue.fmt

Filesize
61KB

MD5
3422424b54d58a055741395d5aef94ba

SHA1
3175ba8ed993af4a0388c4b0a23b7d7b1eda65c5

SHA256
f6f6a5f42c96717acf4a0f1b77a62ecae4b285a1f0dc3eb8a225aa438c9d103f

SHA512
2a4884159ce73ebdab6fa06bf712a017cf4fb0d93602d987202a7ba28f63b00aca8654a2eb88da10ffba55138aada262e9068529978f45149688a958050205ee

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\z.fmt

Filesize
73KB

MD5
41e4d397ef19e7050d3aa764f12b7d49

SHA1
d6fd6a8a95893d83c7ad9cfb6b24b1fb2c1ab016

SHA256
008a2e98ef3bcfe32e48494e477d67ddd86eff8dfe5d6c0b803b497c3c541852

SHA512
c092bfe194df0d0e296839ada5c3faae82556290b387438decc6fd72e0c2a22c3cd51908e20c56e42b8c4fe16f51a267a573f80d21fc2ed966b545ecabea5747

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Languages\en\winrar.lng

Filesize
41KB

MD5
74ceeceb45edaf5f90ad7345cc436b63

SHA1
c5a542c09284bf5596992c27853b2be4eb819859

SHA256
d5fe16564572732c6622dafcf2e4fa22d9e0d598e4fe99d72fe5e13a33d7d613

SHA512
638a52525bc2b14bc8ef35222731fcb6b0ae7fa89a2f09c1adf3afc071d532c06ea4d3a202f2c225b583856629f8ac9812630f64d95ba395f62f642fccd71674

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Launch WinRAR.exe

Filesize
1.3MB

MD5
641e015eb74fd8a69b4983100b641228

SHA1
7e25bce73b2cce69ddfc2678391beb702607bb8d

SHA256
d7a337208ae2f2037e9ca54f304083790cf6480600efee1ec8ed6c3b2af39ba8

SHA512
2948db7a257606064502dc3c3e89e094da2c3391d2581eec2597f52ab735d3d53157b296518dfd89b9e0866f2b45dd005336d129225c775024e7c2d209176685

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Launch WinRAR.exe

Filesize
1.3MB

MD5
641e015eb74fd8a69b4983100b641228

SHA1
7e25bce73b2cce69ddfc2678391beb702607bb8d

SHA256
d7a337208ae2f2037e9ca54f304083790cf6480600efee1ec8ed6c3b2af39ba8

SHA512
2948db7a257606064502dc3c3e89e094da2c3391d2581eec2597f52ab735d3d53157b296518dfd89b9e0866f2b45dd005336d129225c775024e7c2d209176685

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\Rar.exe

Filesize
369KB

MD5
2d33aae61fab14135d08acb37a0f7ec7

SHA1
4e86dda304ba6edf78301c3785fdbaf070039318

SHA256
9e8ee6b7391aeaec4b3d5f06c8906cb6f0f202e5ed07369343ff81c674d6525e

SHA512
a334fe9831839f19d213036cd5a4d02e0156267b73c4181db80631fd708c43f498e2ef0bc91889e88e1256ceeef1d20b9b592baba174a85731264826321589b3

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\RarExtLoader.exe

Filesize
44KB

MD5
e45118e74fc72169690827841c2f85be

SHA1
d1ff77e204e83a366aac5c5a7d205ed71796216a

SHA256
bc977ffc9de322f2cdedf25eaa3f1e96b60e58ec9b553fb3546faa798a14dea4

SHA512
995da44bcf39560398784404b24a65cd28a72f210a36257abde49fa1ba1e4e498f4771fd9e9b088822438311b78f8801ce89f0ce887d76aadeae2e0b60d6ae0b

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\UnRAR.exe

Filesize
240KB

MD5
d5cfde06873a24a7e04dba14400efc3c

SHA1
e6aae74c30c0df4eb4382d5004398c87d7e2fc19

SHA256
f74ffe1a71ac9b7523d603dade3c6185a91ddf36ade4ecd41d247628d08b6ebb

SHA512
e2630b19be8bb023a1697b44b0029a8f072a5866cdeccb291d755f2f77f6f0d02fc2fd097f8775d3a397812f78a721f88e6dcc20ec8924bca03376041195e3e7

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\WinRAR.exe

Filesize
1014KB

MD5
158f8e46ab4809937f8800058374e797

SHA1
dbfb1ca4111488ce08388774f2d731c7782e09c9

SHA256
6ab5ea0d5f74a215c0434d46a48697b7a994b4ce8d5f54c5239e05ce8365aa5d

SHA512
be514b8381400c092c615a49717f05ad5583abcfd19979d9f1eea841ec197cbf4d3518dd92792ce79c490bb270ce2968ebeb92210cfdeb69d896883b1d34339e

Download Submit
C:\Users\Admin\Desktop\New folder\WinRAR Unplugged\winrar.rcf

Filesize
7KB

MD5
aab5ebc5bd643e841c97b73fd24b3508

SHA1
228a4affd3248d379567440a942c121b8226a19d

SHA256
a149ab63f2c03cedec691918600dcbb8f47d3061ce04501a541b76923df393f2

SHA512
8d52512db11317bd66d0e4b38ca2aa48f99cc0cf9f8b2072ca0c08930fab9891eafa896b13bd725d4f8ff32f5a42bdf5ea9f7928b1a6cd177ce17619b1fcc1bf

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\7z.fmt

Filesize
79KB

MD5
995e32816fd7c6ddbf492f87adc8c145

SHA1
211f9d471eb8fb0da651286316e8d15bef20b736

SHA256
df53923a727944d05bc2f6ffd20ed02ea5f9cedb7a8f497191df3b7a15b35072

SHA512
cdde7b4c4957b14c7937aa50478284eba93ac0036e47c797979e0787a41d55f826862b0a670251e0f3cd103a2f4ccb3bde982dffefcf5816285c299c482ef6a9

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\ace.fmt

Filesize
81KB

MD5
2d3fa60d3e7579ac9e45ec1db7f27057

SHA1
f6ab555168e1a2e1a9202158300fff57d3c9b7af

SHA256
36dafa540b5fc464638e2a98189b12813783e7567dd7b2d54ff9475251298ad9

SHA512
d656e986cf26a17ac130324e0ad649f90a615a057a304121d3aba86bca9e709150410cbd33e2e205799d8ba35eb77445ddab62a3811241ebe22b910a6344f027

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\arj.fmt

Filesize
69KB

MD5
456603cb634faa56f0603ba758475246

SHA1
028188e94749a5e1e8a7dcd09389de5697323ed7

SHA256
fad9d84b1046ba83cc328729f527a2ec0b74ce367690d2324f04e665908429df

SHA512
670be16b68ac0675849195dd06748b63acd37e3791425f133c11807747d988e9d59c1aabe95708684917a9352089d4a299b720b6f530b0330825410fb4305c89

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\bz2.fmt

Filesize
87KB

MD5
30ddd664b909af20ae8ceea59c8ea60e

SHA1
34a4a18e3cb0ed775d3192678cd348a9fec58b92

SHA256
770099458f9298b8a22c1ca44b9f7e635ca272d74e2387b7d58829632723be9f

SHA512
37bb0cbd720c8fa64e20f2c0e1473244812540d24d2e6bee564c2e44a83cbe43efe29380482b28f1933c962e61aea4f90efe730537cf468ab9db9d9c041fbe20

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\cab.fmt

Filesize
63KB

MD5
b59abd0918120b43e866b17100d29674

SHA1
88db8f935a245473db4d5452c4da7576c07eb00c

SHA256
b7a35b47040be0cb534385ad11975c7a1957366893466c97f6bbe8def597c281

SHA512
55bc50613da4294c1170da97140be5998d709ccdeee1f4d2919dba3fe52a9dc4dbe3f9b584944a676f42629be7029a0bc82100e2c19a5b25a52578460c93e743

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\gz.fmt

Filesize
79KB

MD5
01cfaeed15f6a6c47846807ff6f6602f

SHA1
0cc885e54d5dd031291e37663e918b05ee50c518

SHA256
3cec3960959f252c0c97ea0a63994af4a3e4a2ee9e550a0f91543fd1eb164e28

SHA512
f22f5b75f4e2583d7fe2e20656f285f6119770dc76a7bfb0f5728ae757946ff648d164bbff8e6f979e3c941638c71e6a453457dfc86ebf259cae546dad7c8fc5

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\iso.fmt

Filesize
80KB

MD5
d6bf07ce6ef4196887a97be29cd749cf

SHA1
7419f1ac00b15754edc1679cddd9bef168015672

SHA256
a74c9fa10a7f137d1a66a929e09c2fee31e508a6f18af8d174d7a10924e08b61

SHA512
0e9173cc308be10dc87aa0462f22edf1bc058034f01acfb60512c10c63cea0055ad1c8b359177841e62d6e0420bc49cd5c50179ed4d5c712430e91e297344e49

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\lzh.fmt

Filesize
80KB

MD5
d2b491c5541538371e4ceb49209ac73c

SHA1
66dfccb9dd10ef0929b39da082807a7a51eb8dfc

SHA256
fba57b8318f5212d94f323f3df01be9d7db0adb32fdc119910d71f315fae8b82

SHA512
a0cf3fcf9606749ffd786d7a375761d3abd889abc9e355a33e125a203734b2abd8ecf4d2032a0902ad0bdf7a9759e7ce555525b39c05ff3ac3454857d09d128d

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\tar.fmt

Filesize
68KB

MD5
692e9335b118351035defdc7556b4d55

SHA1
874f38dc0b75cc37ecde0b601e198a77716c267f

SHA256
454bb9bc8bcc4065e0e9e17c2ffaa250e1b3b46d1aa97243a5ecdf31ccfbadf0

SHA512
a0445950b77e373f5faeed146b6d2cf37a4365a547699bd9011736d34f5d21f67ba9f35c1be28815e3ac973a4550fa651b8a11d2f0066baa7d59582edb47c66a

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\uue.fmt

Filesize
61KB

MD5
3422424b54d58a055741395d5aef94ba

SHA1
3175ba8ed993af4a0388c4b0a23b7d7b1eda65c5

SHA256
f6f6a5f42c96717acf4a0f1b77a62ecae4b285a1f0dc3eb8a225aa438c9d103f

SHA512
2a4884159ce73ebdab6fa06bf712a017cf4fb0d93602d987202a7ba28f63b00aca8654a2eb88da10ffba55138aada262e9068529978f45149688a958050205ee

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Formats\z.fmt

Filesize
73KB

MD5
41e4d397ef19e7050d3aa764f12b7d49

SHA1
d6fd6a8a95893d83c7ad9cfb6b24b1fb2c1ab016

SHA256
008a2e98ef3bcfe32e48494e477d67ddd86eff8dfe5d6c0b803b497c3c541852

SHA512
c092bfe194df0d0e296839ada5c3faae82556290b387438decc6fd72e0c2a22c3cd51908e20c56e42b8c4fe16f51a267a573f80d21fc2ed966b545ecabea5747

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Launch WinRAR.exe

Filesize
1.3MB

MD5
641e015eb74fd8a69b4983100b641228

SHA1
7e25bce73b2cce69ddfc2678391beb702607bb8d

SHA256
d7a337208ae2f2037e9ca54f304083790cf6480600efee1ec8ed6c3b2af39ba8

SHA512
2948db7a257606064502dc3c3e89e094da2c3391d2581eec2597f52ab735d3d53157b296518dfd89b9e0866f2b45dd005336d129225c775024e7c2d209176685

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\Rar.exe

Filesize
369KB

MD5
2d33aae61fab14135d08acb37a0f7ec7

SHA1
4e86dda304ba6edf78301c3785fdbaf070039318

SHA256
9e8ee6b7391aeaec4b3d5f06c8906cb6f0f202e5ed07369343ff81c674d6525e

SHA512
a334fe9831839f19d213036cd5a4d02e0156267b73c4181db80631fd708c43f498e2ef0bc91889e88e1256ceeef1d20b9b592baba174a85731264826321589b3

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\RarExtLoader.exe

Filesize
44KB

MD5
e45118e74fc72169690827841c2f85be

SHA1
d1ff77e204e83a366aac5c5a7d205ed71796216a

SHA256
bc977ffc9de322f2cdedf25eaa3f1e96b60e58ec9b553fb3546faa798a14dea4

SHA512
995da44bcf39560398784404b24a65cd28a72f210a36257abde49fa1ba1e4e498f4771fd9e9b088822438311b78f8801ce89f0ce887d76aadeae2e0b60d6ae0b

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\UnRAR.exe

Filesize
240KB

MD5
d5cfde06873a24a7e04dba14400efc3c

SHA1
e6aae74c30c0df4eb4382d5004398c87d7e2fc19

SHA256
f74ffe1a71ac9b7523d603dade3c6185a91ddf36ade4ecd41d247628d08b6ebb

SHA512
e2630b19be8bb023a1697b44b0029a8f072a5866cdeccb291d755f2f77f6f0d02fc2fd097f8775d3a397812f78a721f88e6dcc20ec8924bca03376041195e3e7

Download Submit
\Users\Admin\Desktop\New folder\WinRAR Unplugged\WinRAR.exe

Filesize
1014KB

MD5
158f8e46ab4809937f8800058374e797

SHA1
dbfb1ca4111488ce08388774f2d731c7782e09c9

SHA256
6ab5ea0d5f74a215c0434d46a48697b7a994b4ce8d5f54c5239e05ce8365aa5d

SHA512
be514b8381400c092c615a49717f05ad5583abcfd19979d9f1eea841ec197cbf4d3518dd92792ce79c490bb270ce2968ebeb92210cfdeb69d896883b1d34339e

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads