a45d5a7538790a3388e390118b4fa6f5a0ca3245fa64072f5807b303035d0ec9

Analysis

max time kernel
292s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28/03/2023, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rar_password_unlocker_trial-5.0.exe
Size

12.7MB
MD5

115073414b19ae3258a166962e7603f3
SHA1

5b299551153ea45f68899996d3cccce5cc7ce1c7
SHA256

a45d5a7538790a3388e390118b4fa6f5a0ca3245fa64072f5807b303035d0ec9
SHA512

86da788a8f15b017026a2a4a266f8f82d96c6e9845f32682014eea18dcef9851a3700f949e25bccd8ce35f26a48378f853d512d1bc966aa2301d4ca9864c5412
SSDEEP

393216:5zmPcKtpFUOWdp5BprwNE2PvGbN+8N3cgQWO:5GPaOWdp5BgE2s+8N3VQ5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
832	rar_password_unlocker_trial-5.0.tmp

Loads dropped DLL 3 IoCs

pid	Process
1424	rar_password_unlocker_trial-5.0.exe
832	rar_password_unlocker_trial-5.0.tmp
832	rar_password_unlocker_trial-5.0.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
832	rar_password_unlocker_trial-5.0.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27
PID 1424 wrote to memory of 832	1424	rar_password_unlocker_trial-5.0.exe	27

C:\Users\Admin\AppData\Local\Temp\rar_password_unlocker_trial-5.0.exe
"C:\Users\Admin\AppData\Local\Temp\rar_password_unlocker_trial-5.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\is-8BBI3.tmp\rar_password_unlocker_trial-5.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8BBI3.tmp\rar_password_unlocker_trial-5.0.tmp" /SL5="$70124,13052356,69632,C:\Users\Admin\AppData\Local\Temp\rar_password_unlocker_trial-5.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8BBI3.tmp\rar_password_unlocker_trial-5.0.tmp

Filesize
702KB

MD5
ffee2cde34061528bbdb396fb6a3d493

SHA1
48c889b8e668aec8d9630ff5e8d96044213c9706

SHA256
d9017436ef3f4c1bfd8584f56788f18a6a251ada6c767d7b94c97db808ac15da

SHA512
e3a0f3a21604cf43c46db8e96b63bab840790ac75ab9c760aaef2f0f8faa28eb2f0217271c1956b2a4c6b0cddbe7806cb186c2371abe40820a362aca7bfb6f88

Download Submit
\Users\Admin\AppData\Local\Temp\is-8BBI3.tmp\rar_password_unlocker_trial-5.0.tmp

Filesize
702KB

MD5
ffee2cde34061528bbdb396fb6a3d493

SHA1
48c889b8e668aec8d9630ff5e8d96044213c9706

SHA256
d9017436ef3f4c1bfd8584f56788f18a6a251ada6c767d7b94c97db808ac15da

SHA512
e3a0f3a21604cf43c46db8e96b63bab840790ac75ab9c760aaef2f0f8faa28eb2f0217271c1956b2a4c6b0cddbe7806cb186c2371abe40820a362aca7bfb6f88

Download Submit
\Users\Admin\AppData\Local\Temp\is-MJD5N.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MJD5N.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/832-67-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/832-69-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1424-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1424-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads