metasploit | 6e55531e2205c2f9242a9b2cd9303b60ec9699e0fab26b1e5a7f9f97136ad647

General

Target

wrar393es.exe
Size

1.4MB
MD5

5de35fab0bd47243ebdab45b64cac273
SHA1

cee9d0dee8b91952ad03692c9485fe24ceff72e6
SHA256

6e55531e2205c2f9242a9b2cd9303b60ec9699e0fab26b1e5a7f9f97136ad647
SHA512

09a8b9d035c9fa67322f50f5a6d903b4bc5aa3028bcda1e218a48922b27baf1867180c754410c94dcc77013d31b7ea3f3a0d67ca8e542f23fbeaaf61a161db0d
SSDEEP

24576:G38+om3OL/FTrSSZFY0KdfYhMSnb4biHUy+2PBUnNwhqSoocQhP5+BYbNDJu+6kL:G74/Fv9hKdfIvb2iH/JiNWVtcQh5+6ga

Score

10^/10

metasploit backdoor discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

172.20.10.7:2425

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

uninstall.exe

pid process

2896 uninstall.exe
Loads dropped DLL 3 IoCs

Processes:

wrar393es.exeuninstall.exe

pid process

1796 wrar393es.exe
2896 uninstall.exe
2896 uninstall.exe

pid	process
2896	uninstall.exe

pid	process
1796	wrar393es.exe
2896	uninstall.exe
2896	uninstall.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

uninstall.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

uninstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files (x86)\\WinRAR\\rarext64.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

wrar393es.exeuninstall.exe

description	ioc	process
File created	C:\Program Files (x86)\WinRAR\Formats\lzh.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\File_Id.diz	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\ace.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Rar.txt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Uninstall.lst	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\uue.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\z.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\RarExtLoader.exe	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\UNACEV2.DLL	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\arj.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\__tmp_rar_sfx_access_check_259405747	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\tar.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Winrar.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\UnrarSrc.txt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Uninstall.exe	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\WinRAR.exe	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\7zxa.dll	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\bz2.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\bz2.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\cab.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\NotasTec.txt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Novedades.txt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Rar.exe	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Uninstall.lng	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\arj.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\cab.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Winrar.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\UNACEV2.DLL	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\ace.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\lzh.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Uninstall.lng	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\WinCon.sfx	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\RarExtLoader.exe	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\WinRAR.exe	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\7zxa.dll	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\WinCon.sfx	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Rar.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\UnRAR.exe	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\RarExt64.dll	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\gz.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\UnRAR.exe	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Rar.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Rarext.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Uninstall.lst	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Rar.exe	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Uninstall.exe	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\7z.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Rarext.lng	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\File_Id.diz	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Leame.txt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Order.htm	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\zip.sfx	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\RarExt.dll	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\NotasTec.txt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\RarFiles.lst	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\licencia.rtf	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\RarExt64.dll	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\Formats\iso.fmt	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\iso.fmt	wrar393es.exe
File created	C:\Program Files (x86)\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files (x86)\WinRAR\Descript.ion	wrar393es.exe
File opened for modification	C:\Program Files (x86)\WinRAR\Descript.ion	wrar393es.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

wrar393es.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main wrar393es.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	wrar393es.exe

Modifies registry class 64 IoCs

Processes:

uninstall.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ace	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files (x86)\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r28	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r05	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r08\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "Archivo WinRAR ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r07	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

wrar393es.exe

pid process

1796 wrar393es.exe
1796 wrar393es.exe

pid	process
1796	wrar393es.exe
1796	wrar393es.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wrar393es.exe

description	pid	process	target process
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe
PID 1796 wrote to memory of 2896	1796	wrar393es.exe	uninstall.exe

C:\Users\Admin\AppData\Local\Temp\wrar393es.exe
"C:\Users\Admin\AppData\Local\Temp\wrar393es.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796

C:\Program Files (x86)\WinRAR\uninstall.exe
"C:\Program Files (x86)\WinRAR\uninstall.exe" /setup
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinRAR\Rar.txt

Filesize
82KB

MD5
6b2cfe8949ebe63453f0c936fdfe3ca1

SHA1
724b53ecbf2f515480b8eff7166b84fa65bd5646

SHA256
ea3cfb9a913a02a2ecdd8efddae6e0aa2876963bb84f361ee6fa54df625aa099

SHA512
bf43a133dde60f340f9f927c98bc27c1e29dcbc5574d2a46af07911b5d939f0a14ed578d0388c35820067eabb41ffa8350bb30640dc22b8f889a2b22733de7d6

Download Submit
C:\Program Files (x86)\WinRAR\WinRAR.exe

Filesize
1015KB

MD5
b284e0f20811226bc0211bf742247542

SHA1
abbedb56afe58b76b80732f42995f8500334b604

SHA256
aa3db28e89b5e48128c8a63b197ab5f58677416fcd4013f9b8752983bc2e6359

SHA512
082f27ed3b5310562c297892165f158485f989b68f26ce5283f29c3542bbd0fb21379fd9ef6cf656136a7c71fb5c774391a171852d985dbc9a844e8f8c77e180

Download Submit
C:\Program Files (x86)\WinRAR\uninstall.lng

Filesize
3KB

MD5
6627e3a304e7eb57eab9119922f84699

SHA1
b1b9f8b91bc3bd164e00d9b2ff84525830baeab0

SHA256
69a7583ab80fe44a8ff923360d22b282c6c963784361704874f06610fae942ce

SHA512
d4c2bb32f496e67126186b3b887f6b9b9a984769a1d1cf591380532b808c592ed7bc92492a8a8394c417adf2a766d3a73bf05360a2889c339859af598d619c47

Download Submit
C:\Program Files (x86)\WinRAR\winrar.chm

Filesize
287KB

MD5
0f084c219f910c74d18cf15e62f1b200

SHA1
3921ed7dc84d90183f176de1e8d43ac629baaa50

SHA256
0c193b40aed6e25a6e316c192344f0895cc0e415a745573c4a28052634abc03b

SHA512
9a0af963c264fadb3490b9945f7195f6f83b9f4c0e0b508f70fc1d61880847b11ab5104b9ef2e6d79caf15ac5db4586a772134d8cca8df7be41bcefc4692f9eb

Download Submit
\Program Files (x86)\WinRAR\Uninstall.exe

Filesize
118KB

MD5
eef1a4f707778f6659ae9cb26b128eb9

SHA1
d048f25ac6f21d136487d51c95af1688e27003cc

SHA256
353fe961b123f048d02944449d556a4706eb6212decee71fe720ab9e7dad1cec

SHA512
3969939e569e8419d07ea8301c051f69dafb8c4141903b858973b0a702158942903b96e94479ecfcbc9e54ebb630263d4ae590ae10156278f0270f0cfb4d0d13

Download Submit
memory/1796-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1796-91-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads