Overview

overview

5

Static

static

1

winrar-x64-701.exe

windows7-x64

5

winrar-x64-701.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    53s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2024 14:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    winrar-x64-701.exe

  • Size

    3.8MB

  • MD5

    46c17c999744470b689331f41eab7df1

  • SHA1

    b8a63127df6a87d333061c622220d6d70ed80f7c

  • SHA256

    c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

  • SHA512

    4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

  • SSDEEP

    98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB

Score
5/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Modifies registry class
      PID:1644
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2340
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\ConfirmApprove.rar"
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:2912
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\AddSet.cab"
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:1916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\WinRAR\Rar.txt
      Filesize

      105KB

      MD5

      b954981a253f5e1ee25585037a0c5fee

      SHA1

      96566e5c591df1c740519371ee6953ac1dc6a13f

      SHA256

      59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

      SHA512

      6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

      Download Submit

    • C:\Program Files\WinRAR\WhatsNew.txt
      Filesize

      45KB

      MD5

      1c44c85fdab8e9c663405cd8e4c3dbbd

      SHA1

      74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

      SHA256

      33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

      SHA512

      46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

      Download Submit

    • C:\Program Files\WinRAR\WinRAR.chm
      Filesize

      316KB

      MD5

      6ca1bc8bfe8b929f448e1742dacb8e7f

      SHA1

      eca3e637db230fa179dcd6c6499bd7d616f211e8

      SHA256

      997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

      SHA512

      d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

      Download Submit

    • C:\Program Files\WinRAR\WinRAR.exe
      Filesize

      3.1MB

      MD5

      53cf9bacc49c034e9e947d75ffab9224

      SHA1

      7db940c68d5d351e4948f26425cd9aee09b49b3f

      SHA256

      3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3

      SHA512

      44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda

      Download Submit

    • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
      Filesize

      12B

      MD5

      a6836c8741839de99a294a834c3b9dd1

      SHA1

      08ce4dad677747b9cf7b4ffd7f39d0f130036890

      SHA256

      d714f21ebccd1aa542331e755e1f9fee78afb5e13d16f080f037a681c330cc1d

      SHA512

      b748754e1404b6d00b2a5c95ac21198b3a3990990d614c1c171650081ca97746622f27cfdab4c17cc470bf8e24ef0f1a673315472510066f6343451fa2b03bcc

      Download Submit

    • \Program Files\WinRAR\Uninstall.exe
      Filesize

      477KB

      MD5

      4783f1a5f0bba7a6a40cb74bc8c41217

      SHA1

      a22b9dc8074296841a5a78ea41f0e2270f7b7ad7

      SHA256

      f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c

      SHA512

      463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e

      Download Submit