Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

winrar-x64-701.exe

windows7-x64

4

winrar-x64-701.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    66s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 23:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    winrar-x64-701.exe

  • Size

    3.7MB

  • MD5

    3a2f16a044d8f6d2f9443dff6bd1c7d4

  • SHA1

    48c6c0450af803b72a0caa7d5e3863c3f0240ef1

  • SHA256

    31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

  • SHA512

    61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

  • SSDEEP

    98304:yNdBfKEHyrVcQky3zy1BK1X4Jg+opzZorSeksMURg0l5OOf:ky+GzkezMs1I5oDot8UeEt

Score
4/10
discoverypersistence

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Registers COM server for autorun
      • Modifies registry class
      PID:2396
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:752
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe"
      1⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\WinRAR\Rar.txt
      Filesize

      105KB

      MD5

      b954981a253f5e1ee25585037a0c5fee

      SHA1

      96566e5c591df1c740519371ee6953ac1dc6a13f

      SHA256

      59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

      SHA512

      6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

      Download Submit

    • C:\Program Files\WinRAR\WhatsNew.txt
      Filesize

      45KB

      MD5

      1c44c85fdab8e9c663405cd8e4c3dbbd

      SHA1

      74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

      SHA256

      33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

      SHA512

      46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

      Download Submit

    • C:\Program Files\WinRAR\WinRAR.chm
      Filesize

      316KB

      MD5

      6ca1bc8bfe8b929f448e1742dacb8e7f

      SHA1

      eca3e637db230fa179dcd6c6499bd7d616f211e8

      SHA256

      997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

      SHA512

      d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

      Download Submit

    • C:\Program Files\WinRAR\WinRAR.exe
      Filesize

      3.1MB

      MD5

      0d76233931dfa993fd9b546bd5229976

      SHA1

      ce8de59e2277e9003f3a9c96260ce099ca7cda6c

      SHA256

      648a5d7064cdf2a86f465ea6b318d0b1ceac905f77c438dac2778a001b50647c

      SHA512

      dd7b6bd5545c60e9ce21fbde35f20d8807bdaf9e4408321f7f709c9324c719f1a9f68648260cfeb7e5f94f4eabc631dd95e348e55d93b32ea12e899d030b91ee

      Download Submit

    • \Program Files\WinRAR\Uninstall.exe
      Filesize

      477KB

      MD5

      d36be447f422abc82276af9cb2f2741b

      SHA1

      f3ba2f58a88086f1b420a7520a5439a9eb851b79

      SHA256

      82a495858708b726f26cb86e2fbab8df86b9008a671be4c1f6c4f24ed3013735

      SHA512

      b9f5ffe578185b2f112d0bba21fdd6677d64986445ff971e9f6e8aa87a4684c0722b97a473150aff2742929fcaa79f6e336bd05d462bbdce149d634eb2f2d3d0

      Download Submit