Analysis
- max time kernel
74s - max time network
19s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
07/11/2024, 09:21
Behavioral task
behavioral1
Sample
c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
- Size 4.2MB
- Sample241107-lbnd3sslgm
- SHA256 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60
- MD5 37acf1f80403c0c18e2812810cc2ff4d
- SHA1 f2e1fb2bab07d7f2ad25e8305a50a169ba9a1fc3
- SHA512 740f888ffaea625dccf738232f5e0c1dd97069e486ed3be61deccda4e1a62da0e56bef58a75726309005450f649a7101079ec06e822b6ebf1ebbb187b4f9a0c4
- SSDEEP 98304:GnniJlWBOWrGZi8sCUvnfq6VIFijV78qQrec2IB3eKYShGfuj:twei8sCUvnfqYyrUIB3eKDgm
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 2004 sg.tmp 1316 Uninstall.exe - Loads dropped DLL 5 IoCs
pid Process 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 1316 Uninstall.exe 1316 Uninstall.exe 1212 Process not Found - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000588000-memory.dmp upx behavioral1/memory/2212-10-0x0000000000400000-0x0000000000588000-memory.dmp upx behavioral1/memory/1736-112-0x0000000000400000-0x0000000000588000-memory.dmp upx - Drops file in Program Files directory 63 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\Uninstall.exe sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png sg.tmp File created C:\Program Files\WinRAR\Default.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\RarExt32.dll sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png sg.tmp File created C:\Program Files\WinRAR\WinCon.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\WinCon32.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\Descript.ion sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix sg.tmp File created C:\Program Files\WinRAR\WinRAR.chm sg.tmp File created C:\Program Files\WinRAR\Default32.SFX sg.tmp File created C:\Program Files\WinRAR\Uninstall.exe sg.tmp File opened for modification C:\Program Files\WinRAR\ReadMe.txt sg.tmp File created C:\Program Files\WinRAR\WinCon32.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png sg.tmp File opened for modification C:\Program Files\WinRAR\rarreg.key sg.tmp File created C:\Program Files\WinRAR\7zxa.dll sg.tmp File opened for modification C:\Program Files\WinRAR\Default.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\Rar.exe sg.tmp File opened for modification C:\Program Files\WinRAR\WinCon.SFX sg.tmp File created C:\Program Files\WinRAR\rarnew.dat Uninstall.exe File created C:\Program Files\WinRAR\zipnew.dat Uninstall.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst sg.tmp File opened for modification C:\Program Files\WinRAR\RarExt.dll sg.tmp File opened for modification C:\Program Files\WinRAR\SetWinRAR.bat c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe File opened for modification C:\Program Files\WinRAR\Resources.pri sg.tmp File created C:\Program Files\WinRAR\RarExt.dll sg.tmp File opened for modification C:\Program Files\WinRAR\UnRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\Rar.txt sg.tmp File created C:\Program Files\WinRAR\WhatsNew.txt sg.tmp File created C:\Program Files\WinRAR\Descript.ion sg.tmp File opened for modification C:\Program Files\WinRAR\Order.htm sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png sg.tmp File opened for modification C:\Program Files\WinRAR\WhatsNew.txt sg.tmp File opened for modification C:\Program Files\WinRAR\7zxa.dll sg.tmp File created C:\Program Files\WinRAR\WinRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\Zip.SFX sg.tmp File created C:\Program Files\WinRAR\RarExt32.dll sg.tmp File created C:\Program Files\WinRAR\RarExtInstaller.exe sg.tmp File created C:\Program Files\WinRAR\Zip32.SFX sg.tmp File created C:\Program Files\WinRAR\RarExtPackage.msix sg.tmp File created C:\Program Files\WinRAR\ReadMe.txt sg.tmp File created C:\Program Files\WinRAR\Uninstall.lst sg.tmp File opened for modification C:\Program Files\WinRAR\License.txt sg.tmp File created C:\Program Files\WinRAR\Resources.pri sg.tmp File opened for modification C:\Program Files\WinRAR\Default32.SFX sg.tmp File created C:\Program Files\WinRAR\Rar.exe sg.tmp File created C:\Program Files\WinRAR\UnRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\WinRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\WinRAR.chm sg.tmp File opened for modification C:\Program Files\WinRAR\Zip32.SFX sg.tmp File created C:\Program Files\WinRAR\License.txt sg.tmp File created C:\Program Files\WinRAR\RarFiles.lst sg.tmp File opened for modification C:\Program Files\WinRAR\RarFiles.lst sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe sg.tmp File created C:\Program Files\WinRAR\Zip.SFX sg.tmp File created C:\Program Files\WinRAR\Order.htm sg.tmp File created C:\Program Files\WinRAR\Rar.txt sg.tmp File created C:\Program Files\WinRAR\rarreg.key sg.tmp File created C:\Program Files\WinRAR\SetWinRAR.bat sg.tmp File opened for modification C:\Program Files\WinRAR\SetWinRAR.bat sg.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zst Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 修復分割檔" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 壓縮檔" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gz Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" Uninstall.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeBackupPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeCreateGlobalPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeBackupPrivilege 2212 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 2212 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2212 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2212 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 2004 sg.tmp Token: 35 2004 sg.tmp Token: SeSecurityPrivilege 2004 sg.tmp Token: SeSecurityPrivilege 2004 sg.tmp Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeDebugPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2364 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 30 PID 1736 wrote to memory of 2364 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 30 PID 1736 wrote to memory of 2364 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 30 PID 1736 wrote to memory of 2364 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 30 PID 1736 wrote to memory of 2212 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 32 PID 1736 wrote to memory of 2212 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 32 PID 1736 wrote to memory of 2212 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 32 PID 1736 wrote to memory of 2212 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 32 PID 1736 wrote to memory of 2004 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 33 PID 1736 wrote to memory of 2004 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 33 PID 1736 wrote to memory of 2004 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 33 PID 1736 wrote to memory of 2004 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 33 PID 1736 wrote to memory of 1316 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 35 PID 1736 wrote to memory of 1316 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 35 PID 1736 wrote to memory of 1316 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 35 PID 1736 wrote to memory of 1316 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 35 PID 1736 wrote to memory of 3024 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 36 PID 1736 wrote to memory of 3024 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 36 PID 1736 wrote to memory of 3024 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 36 PID 1736 wrote to memory of 3024 1736 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 36 PID 3024 wrote to memory of 2792 3024 cmd.exe 38 PID 3024 wrote to memory of 2792 3024 cmd.exe 38 PID 3024 wrote to memory of 2792 3024 cmd.exe 38 PID 3024 wrote to memory of 2560 3024 cmd.exe 39 PID 3024 wrote to memory of 2560 3024 cmd.exe 39 PID 3024 wrote to memory of 2560 3024 cmd.exe 39 PID 3024 wrote to memory of 980 3024 cmd.exe 40 PID 3024 wrote to memory of 980 3024 cmd.exe 40 PID 3024 wrote to memory of 980 3024 cmd.exe 40 PID 3024 wrote to memory of 1324 3024 cmd.exe 41 PID 3024 wrote to memory of 1324 3024 cmd.exe 41 PID 3024 wrote to memory of 1324 3024 cmd.exe 41 PID 3024 wrote to memory of 2032 3024 cmd.exe 43 PID 3024 wrote to memory of 2032 3024 cmd.exe 43 PID 3024 wrote to memory of 2032 3024 cmd.exe 43 PID 3024 wrote to memory of 2600 3024 cmd.exe 44 PID 3024 wrote to memory of 2600 3024 cmd.exe 44 PID 3024 wrote to memory of 2600 3024 cmd.exe 44 PID 3024 wrote to memory of 1548 3024 cmd.exe 45 PID 3024 wrote to memory of 1548 3024 cmd.exe 45 PID 3024 wrote to memory of 1548 3024 cmd.exe 45 PID 3024 wrote to memory of 1340 3024 cmd.exe 46 PID 3024 wrote to memory of 1340 3024 cmd.exe 46 PID 3024 wrote to memory of 1340 3024 cmd.exe 46 PID 3024 wrote to memory of 1396 3024 cmd.exe 47 PID 3024 wrote to memory of 1396 3024 cmd.exe 47 PID 3024 wrote to memory of 1396 3024 cmd.exe 47 PID 3024 wrote to memory of 2352 3024 cmd.exe 48 PID 3024 wrote to memory of 2352 3024 cmd.exe 48 PID 3024 wrote to memory of 2352 3024 cmd.exe 48 PID 3024 wrote to memory of 564 3024 cmd.exe 49 PID 3024 wrote to memory of 564 3024 cmd.exe 49 PID 3024 wrote to memory of 564 3024 cmd.exe 49 PID 3024 wrote to memory of 2196 3024 cmd.exe 50 PID 3024 wrote to memory of 2196 3024 cmd.exe 50 PID 3024 wrote to memory of 2196 3024 cmd.exe 50 PID 3024 wrote to memory of 2308 3024 cmd.exe 51 PID 3024 wrote to memory of 2308 3024 cmd.exe 51 PID 3024 wrote to memory of 2308 3024 cmd.exe 51 PID 3024 wrote to memory of 2336 3024 cmd.exe 52 PID 3024 wrote to memory of 2336 3024 cmd.exe 52 PID 3024 wrote to memory of 2336 3024 cmd.exe 52 PID 3024 wrote to memory of 2384 3024 cmd.exe 53 PID 3024 wrote to memory of 2384 3024 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe"C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\cmd.execmd.exe /c set2⤵PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exePECMD**pecmd-cmd* PUTF -dd -skipb=1034752 -len=3344959 "C:\Users\Admin\AppData\Local\Temp\~1673732836164737333.tmp",,C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\~1421480831065519287~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~1673732836164737333.tmp" -y -aoa -o"C:\Program Files\WinRAR"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Program Files\WinRAR\Uninstall.exe"C:\Program Files\WinRAR\Uninstall.exe" /setup /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
PID:1316
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Program Files\WinRAR\SetWinRAR.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\System32\reg.exeReg query "HKU\S-1-5-19\Environment"3⤵PID:2792
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrTo" /t REG_DWORD /d "1" /f3⤵PID:2560
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrHere" /t REG_DWORD /d "1" /f3⤵PID:980
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Extr" /t REG_DWORD /d "1" /f3⤵PID:1324
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrSep" /t REG_DWORD /d "1" /f3⤵PID:2032
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "OpenSFX" /t REG_DWORD /d "1" /f3⤵PID:2600
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "AddTo" /t REG_DWORD /d "1" /f3⤵PID:1548
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "AddArc" /t REG_DWORD /d "0" /f3⤵PID:1340
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "EmailArc" /t REG_DWORD /d "0" /f3⤵PID:1396
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "EmailOpt" /t REG_DWORD /d "0" /f3⤵PID:2352
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Test" /t REG_DWORD /d "0" /f3⤵PID:564
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Convert" /t REG_SZ /d "" /f3⤵PID:2196
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "NewRAR" /t REG_DWORD /d "0" /f3⤵PID:2308
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "NewZIP" /t REG_DWORD /d "0" /f3⤵PID:2336
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "ShellExt" /t REG_DWORD /d "1" /f3⤵PID:2384
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "CascadedMenu" /t REG_DWORD /d "1" /f3⤵PID:1960
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "MenuIcons" /t REG_DWORD /d "1" /f3⤵PID:1424
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\General" /v "History" /t REG_DWORD /d "0" /f3⤵PID:2464
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\General" /v "DlgHistory" /t REG_DWORD /d "0" /f3⤵PID:2452
-
-
C:\Windows\System32\reg.exeReg query "HKU\S-1-5-19\Environment"3⤵PID:1644
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 73KB
- SHA256 b575226fb02e2ec0282c5fb3ac0a2ab6c99c2d21e5ad45f86e685bb2067b681d
- MD5 a90956374dd2e09fc3d3c1573175add1
- SHA1 d519affec7ed24fae949bb296c558128006ab2e4
- SHA512 547644ed8acc06fd573adca78ee1186a1e4d5fdeb8622cb49374f43bd2434ae845c7449a50bb5bff6c2ca2ce767b9fc1ba0899313c47518e05076de08774d9a9
- SSDEEP 1536:oz7Y2sAqttpiBQDQjgt8dC/A0KsuKbTtcPUKERB+S:orqn/4aKJKKPUKERBR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\SetWinRAR.bat
- Size 2KB
- SHA256 65a07da1dfcdf2e0a1122ee2573db7e1e16c4b91e0d9dc212d8f4781841a9d68
- MD5 af0d6eb9093ce27ed02d5426b2332d90
- SHA1 7e0e44a6ee8d954f81b48aa5da8a4b7fe6644ddc
- SHA512 9fc96e5d967185434a53d538bf8adc63d474ac4143ce0ca60abda9e61f5a172095ab5e38482339012fa512e541fb41036bc351301a07e91f5c71cb4794cecd02
- MD5 SHA1 SHA512
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 31KB
- SHA256 0ea4c8591aa480a4661a105fc6e3f3843ffa6f6b806caed19ee88cc05d87aa12
- MD5 d9d6f5faf6a8e7201aa5a97fb6f4c7bd
- SHA1 8e672e1751d5601bb0efa608599b1d2f6282b762
- SHA512 ff223d4722c82f281dfb1cef90f30d1606734b56b2951047a0737d1cbb96ae13437c27b70773bbcd548eb79be8346da0fb35da599b28d1704fc273f3637b8814
- SSDEEP 384:CVPg8UfR2xkqd4ypPMck2NLJ5RWzoUL7YAGsF3s4kBdftogn633u8MMv2KiZwB7F:JPfYFPMcjbEoUPS/ftWPMQywn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 574KB
- SHA256 415be033b4932638d8eb6a0070b1a79da5c1aa0f1fa282dab929e85d1f42f387
- MD5 34803203d25500f52ca158a438a0d907
- SHA1 b097f2a4ff4077529f64ba10400b2b4f775ea6fa
- SHA512 4f86f791259053de84ba229d07127696ab9995da9936070e83959e94fab2ca126cc0a9dd47371f30961e03b2380b05bd9d99ff558cbe2a4e38e9b2eda5e3406c
- SSDEEP 12288:8wpfrYJchDADAn1GXdB1E/ouTnhxSy6U81aeSM1c0qEaT:vYG1cBu/XYSkSEaT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.1MB
- SHA256 cc46d8ec308738a45b7ee864367039d60e2b8ab7bf6627e5e6a716ce1d27fa7d
- MD5 df5a68178162180029f3dd2a0508f070
- SHA1 6f347610eb96c7a0b7fbb478621dedf2eac30d84
- SHA512 1305de0645b4c11081cb622c7b2d34aa275db35f8ed896e182db0c58fdac4416a2796c6ee9225326142232cb2a5783a4b074a24e5ad96a91f3141e13a3a65cb8
- SSDEEP 49152:Wlh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlCzt5JSXeBdH370:WMgZeD+h3zJ7Bpr0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~1673732836164737333.tmp
- Size 3.2MB
- SHA256 c81bfc0c51683b64113b8df8d879e9b9257a3d9692e3c207c1f9c6835c915403
- MD5 bd4918530a56e1e0a3f017a4e60bfcba
- SHA1 eb24eb9425ae409410f20fda971354d80b7d97d4
- SHA512 15ce15a72d1d721edef725416caa2a97e2155edcd4635198a27c4bec5ba3ae70287a3d74957fd72c0716652f58e65060eb740d39ece85428f0c0afce9967d5f2
- SSDEEP 98304:TrGZi8sCUvnfq6VIFijV78qQrec2IB3eKYShGfuj8:Tei8sCUvnfqYyrUIB3eKDgmY
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\WinRAR\Uninstall.exe
- Size 474KB
- SHA256 fd960dd10f477371a939ea2de1d5ff813dd5832f989e7110a5dac1d928f049a7
- MD5 633673e7998b026bb9c3101d6d1b4e79
- SHA1 383d4e928ad36af46d7d152f45fbe8b73fa4d57d
- SHA512 bf49177d0e1e5aee0dda82f8242f446520fa9a0f1949215b294760ecd82ac2133561f5f7dd20a09a95aa5c09d8a1495a9a0469a8bc126c55efcca2b46aeea766
- SSDEEP 12288:LZ5zraThq5dDnHEJt1kX2wBhvBJ/+GIISY1ASu:LZ5n2hsdDnkGXFBhvn/++1Vu
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\~1421480831065519287~\sg.tmp
- Size 715KB
- SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
- MD5 7c4718943bd3f66ebdb47ccca72c7b1e
- SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
- SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
- SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
- MD5 SHA1 SHA512 SSDEEP