f6ee6a90ebc33b5babe2c8bef23a1344612c6fabf33ac35a523f1583a967d8a6

Analysis

max time kernel
111s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-x64-611sc.exe
Size

3.4MB
MD5

1062a892627017d4fdff30c16d1f49ec
SHA1

8b5e44b97a475c1eb89178efadef0b0ea51b90cb
SHA256

f6ee6a90ebc33b5babe2c8bef23a1344612c6fabf33ac35a523f1583a967d8a6
SHA512

5ba70f0b6ba24dfaaf8d949d37006d6f2ad4f6dd155e50783a2a0cc16bc6f1bc1eff02eebc72b7871129afd934ecf038ca977641efd944fb571296b9363e89ac
SSDEEP

98304:4NrOBfKORPqCNiHnmuMyBE6MT1Iqca/YL:4NxOtjiiDIqdK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-611sc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	winrar-x64-611sc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	winrar-x64-611sc.exe
2028	winrar-x64-611sc.exe

C:\Users\Admin\AppData\Local\Temp\winrar-x64-611sc.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-x64-611sc.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...