Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2024, 09:21
Behavioral task
behavioral1
Sample
c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe
- Size 4.2MB
- Sample241107-lbnd3sslgm
- SHA256 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60
- MD5 37acf1f80403c0c18e2812810cc2ff4d
- SHA1 f2e1fb2bab07d7f2ad25e8305a50a169ba9a1fc3
- SHA512 740f888ffaea625dccf738232f5e0c1dd97069e486ed3be61deccda4e1a62da0e56bef58a75726309005450f649a7101079ec06e822b6ebf1ebbb187b4f9a0c4
- SSDEEP 98304:GnniJlWBOWrGZi8sCUvnfq6VIFijV78qQrec2IB3eKYShGfuj:twei8sCUvnfqYyrUIB3eKDgm
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 4024 sg.tmp 2924 Uninstall.exe - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR Uninstall.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral2/memory/2296-0-0x0000000000400000-0x0000000000588000-memory.dmp upx behavioral2/memory/1364-9-0x0000000000400000-0x0000000000588000-memory.dmp upx behavioral2/memory/2296-101-0x0000000000400000-0x0000000000588000-memory.dmp upx - Drops file in Program Files directory 63 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png sg.tmp File opened for modification C:\Program Files\WinRAR\RarExt.dll sg.tmp File opened for modification C:\Program Files\WinRAR\SetWinRAR.bat sg.tmp File created C:\Program Files\WinRAR\Rar.exe sg.tmp File created C:\Program Files\WinRAR\Zip.SFX sg.tmp File created C:\Program Files\WinRAR\RarFiles.lst sg.tmp File created C:\Program Files\WinRAR\Order.htm sg.tmp File opened for modification C:\Program Files\WinRAR\Resources.pri sg.tmp File created C:\Program Files\WinRAR\WinRAR.exe sg.tmp File created C:\Program Files\WinRAR\Default32.SFX sg.tmp File created C:\Program Files\WinRAR\WinCon.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\Zip.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\License.txt sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png sg.tmp File created C:\Program Files\WinRAR\WinRAR.chm sg.tmp File created C:\Program Files\WinRAR\Rar.txt sg.tmp File opened for modification C:\Program Files\WinRAR\WinCon.SFX sg.tmp File created C:\Program Files\WinRAR\Resources.pri sg.tmp File opened for modification C:\Program Files\WinRAR\Default.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\SetWinRAR.bat c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe File created C:\Program Files\WinRAR\License.txt sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png sg.tmp File created C:\Program Files\WinRAR\ReadMe.txt sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe sg.tmp File opened for modification C:\Program Files\WinRAR\UnRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\WinRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\Descript.ion sg.tmp File created C:\Program Files\WinRAR\7zxa.dll sg.tmp File created C:\Program Files\WinRAR\RarExt32.dll sg.tmp File opened for modification C:\Program Files\WinRAR\ReadMe.txt sg.tmp File opened for modification C:\Program Files\WinRAR\Default32.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\WinRAR.chm sg.tmp File created C:\Program Files\WinRAR\RarExtInstaller.exe sg.tmp File opened for modification C:\Program Files\WinRAR\Zip32.SFX sg.tmp File created C:\Program Files\WinRAR\rarnew.dat Uninstall.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst sg.tmp File created C:\Program Files\WinRAR\SetWinRAR.bat sg.tmp File opened for modification C:\Program Files\WinRAR\Uninstall.lst sg.tmp File opened for modification C:\Program Files\WinRAR\Uninstall.exe sg.tmp File created C:\Program Files\WinRAR\Descript.ion sg.tmp File created C:\Program Files\WinRAR\WhatsNew.txt sg.tmp File created C:\Program Files\WinRAR\Default.SFX sg.tmp File created C:\Program Files\WinRAR\Uninstall.exe sg.tmp File created C:\Program Files\WinRAR\UnRAR.exe sg.tmp File opened for modification C:\Program Files\WinRAR\Order.htm sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix sg.tmp File opened for modification C:\Program Files\WinRAR\7zxa.dll sg.tmp File opened for modification C:\Program Files\WinRAR\Rar.exe sg.tmp File created C:\Program Files\WinRAR\Zip32.SFX sg.tmp File opened for modification C:\Program Files\WinRAR\Rar.txt sg.tmp File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png sg.tmp File created C:\Program Files\WinRAR\RarExtPackage.msix sg.tmp File opened for modification C:\Program Files\WinRAR\WinCon32.SFX sg.tmp File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png sg.tmp File opened for modification C:\Program Files\WinRAR\rarreg.key sg.tmp File opened for modification C:\Program Files\WinRAR\WhatsNew.txt sg.tmp File created C:\Program Files\WinRAR\WinCon32.SFX sg.tmp File created C:\Program Files\WinRAR\zipnew.dat Uninstall.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png sg.tmp File created C:\Program Files\WinRAR\rarreg.key sg.tmp File created C:\Program Files\WinRAR\Uninstall.lst sg.tmp File created C:\Program Files\WinRAR\RarExt.dll sg.tmp File opened for modification C:\Program Files\WinRAR\RarExt32.dll sg.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 壓縮檔" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 修復分割檔" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 壓縮檔" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" Uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" Uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" Uninstall.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeBackupPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeCreateGlobalPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeBackupPrivilege 1364 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 1364 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 1364 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 1364 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeRestorePrivilege 4024 sg.tmp Token: 35 4024 sg.tmp Token: SeSecurityPrivilege 4024 sg.tmp Token: SeSecurityPrivilege 4024 sg.tmp Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeDebugPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: 33 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe Token: SeIncBasePriorityPrivilege 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2372 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 86 PID 2296 wrote to memory of 2372 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 86 PID 2296 wrote to memory of 1364 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 88 PID 2296 wrote to memory of 1364 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 88 PID 2296 wrote to memory of 1364 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 88 PID 2296 wrote to memory of 4024 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 89 PID 2296 wrote to memory of 4024 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 89 PID 2296 wrote to memory of 4024 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 89 PID 2296 wrote to memory of 2924 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 91 PID 2296 wrote to memory of 2924 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 91 PID 2296 wrote to memory of 2184 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 92 PID 2296 wrote to memory of 2184 2296 c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe 92 PID 2184 wrote to memory of 2036 2184 cmd.exe 94 PID 2184 wrote to memory of 2036 2184 cmd.exe 94 PID 2184 wrote to memory of 3876 2184 cmd.exe 95 PID 2184 wrote to memory of 3876 2184 cmd.exe 95 PID 2184 wrote to memory of 3832 2184 cmd.exe 96 PID 2184 wrote to memory of 3832 2184 cmd.exe 96 PID 2184 wrote to memory of 2176 2184 cmd.exe 97 PID 2184 wrote to memory of 2176 2184 cmd.exe 97 PID 2184 wrote to memory of 3420 2184 cmd.exe 98 PID 2184 wrote to memory of 3420 2184 cmd.exe 98 PID 2184 wrote to memory of 1296 2184 cmd.exe 99 PID 2184 wrote to memory of 1296 2184 cmd.exe 99 PID 2184 wrote to memory of 4836 2184 cmd.exe 100 PID 2184 wrote to memory of 4836 2184 cmd.exe 100 PID 2184 wrote to memory of 2376 2184 cmd.exe 101 PID 2184 wrote to memory of 2376 2184 cmd.exe 101 PID 2184 wrote to memory of 980 2184 cmd.exe 102 PID 2184 wrote to memory of 980 2184 cmd.exe 102 PID 2184 wrote to memory of 2336 2184 cmd.exe 103 PID 2184 wrote to memory of 2336 2184 cmd.exe 103 PID 2184 wrote to memory of 368 2184 cmd.exe 104 PID 2184 wrote to memory of 368 2184 cmd.exe 104 PID 2184 wrote to memory of 472 2184 cmd.exe 105 PID 2184 wrote to memory of 472 2184 cmd.exe 105 PID 2184 wrote to memory of 1152 2184 cmd.exe 106 PID 2184 wrote to memory of 1152 2184 cmd.exe 106 PID 2184 wrote to memory of 2472 2184 cmd.exe 107 PID 2184 wrote to memory of 2472 2184 cmd.exe 107 PID 2184 wrote to memory of 4948 2184 cmd.exe 108 PID 2184 wrote to memory of 4948 2184 cmd.exe 108 PID 2184 wrote to memory of 776 2184 cmd.exe 109 PID 2184 wrote to memory of 776 2184 cmd.exe 109 PID 2184 wrote to memory of 828 2184 cmd.exe 110 PID 2184 wrote to memory of 828 2184 cmd.exe 110 PID 2184 wrote to memory of 4308 2184 cmd.exe 111 PID 2184 wrote to memory of 4308 2184 cmd.exe 111 PID 2184 wrote to memory of 760 2184 cmd.exe 112 PID 2184 wrote to memory of 760 2184 cmd.exe 112 PID 2184 wrote to memory of 2040 2184 cmd.exe 113 PID 2184 wrote to memory of 2040 2184 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe"C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c set2⤵PID:2372
-
-
C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exePECMD**pecmd-cmd* PUTF -dd -skipb=1034752 -len=3344959 "C:\Users\Admin\AppData\Local\Temp\~6611156299854263070.tmp",,C:\Users\Admin\AppData\Local\Temp\c40c95a9c16f2899d8975c8249f175f0d5db64f68ca70098ba23a32ff5dfdb60.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\~1625543005910267564~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~6611156299854263070.tmp" -y -aoa -o"C:\Program Files\WinRAR"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Program Files\WinRAR\Uninstall.exe"C:\Program Files\WinRAR\Uninstall.exe" /setup /s2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
PID:2924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\WinRAR\SetWinRAR.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\System32\reg.exeReg query "HKU\S-1-5-19\Environment"3⤵PID:2036
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrTo" /t REG_DWORD /d "1" /f3⤵PID:3876
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrHere" /t REG_DWORD /d "1" /f3⤵PID:3832
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Extr" /t REG_DWORD /d "1" /f3⤵PID:2176
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "ExtrSep" /t REG_DWORD /d "1" /f3⤵PID:3420
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "OpenSFX" /t REG_DWORD /d "1" /f3⤵PID:1296
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "AddTo" /t REG_DWORD /d "1" /f3⤵PID:4836
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "AddArc" /t REG_DWORD /d "0" /f3⤵PID:2376
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "EmailArc" /t REG_DWORD /d "0" /f3⤵PID:980
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "EmailOpt" /t REG_DWORD /d "0" /f3⤵PID:2336
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Test" /t REG_DWORD /d "0" /f3⤵PID:368
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "Convert" /t REG_SZ /d "" /f3⤵PID:472
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "NewRAR" /t REG_DWORD /d "0" /f3⤵PID:1152
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\Setup\MenuItems" /v "NewZIP" /t REG_DWORD /d "0" /f3⤵PID:2472
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "ShellExt" /t REG_DWORD /d "1" /f3⤵PID:4948
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "CascadedMenu" /t REG_DWORD /d "1" /f3⤵PID:776
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup" /v "MenuIcons" /t REG_DWORD /d "1" /f3⤵PID:828
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\General" /v "History" /t REG_DWORD /d "0" /f3⤵PID:4308
-
-
C:\Windows\System32\reg.exeReg add "HKEY_CURRENT_USER\Software\WinRAR\General" /v "DlgHistory" /t REG_DWORD /d "0" /f3⤵PID:760
-
-
C:\Windows\System32\reg.exeReg query "HKU\S-1-5-19\Environment"3⤵PID:2040
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 73KB
- SHA256 b575226fb02e2ec0282c5fb3ac0a2ab6c99c2d21e5ad45f86e685bb2067b681d
- MD5 a90956374dd2e09fc3d3c1573175add1
- SHA1 d519affec7ed24fae949bb296c558128006ab2e4
- SHA512 547644ed8acc06fd573adca78ee1186a1e4d5fdeb8622cb49374f43bd2434ae845c7449a50bb5bff6c2ca2ce767b9fc1ba0899313c47518e05076de08774d9a9
- SSDEEP 1536:oz7Y2sAqttpiBQDQjgt8dC/A0KsuKbTtcPUKERB+S:orqn/4aKJKKPUKERBR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\SetWinRAR.bat
- Size 2KB
- SHA256 ecaf3cd195518c20fa17729c0fc4fb08399e09137cb0bc304cec5161c695f996
- MD5 9293245ace064c707d3b0e0e5aef289e
- SHA1 fae89d11c8f40b801aa6249f4bec6c0e332ea942
- SHA512 39c9c9f5cd04396150d7458af4bff2ad2074352023d2ecf5cd9e27c8c1aac342aab9c05ad6e6386d61d49fa840f15b0dda504437ae27413c57696053575d7bed
- MD5 SHA1 SHA512
- Path C:\Program Files\WinRAR\SetWinRAR.bat
- Size 2KB
- SHA256 65a07da1dfcdf2e0a1122ee2573db7e1e16c4b91e0d9dc212d8f4781841a9d68
- MD5 af0d6eb9093ce27ed02d5426b2332d90
- SHA1 7e0e44a6ee8d954f81b48aa5da8a4b7fe6644ddc
- SHA512 9fc96e5d967185434a53d538bf8adc63d474ac4143ce0ca60abda9e61f5a172095ab5e38482339012fa512e541fb41036bc351301a07e91f5c71cb4794cecd02
- MD5 SHA1 SHA512
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 474KB
- SHA256 fd960dd10f477371a939ea2de1d5ff813dd5832f989e7110a5dac1d928f049a7
- MD5 633673e7998b026bb9c3101d6d1b4e79
- SHA1 383d4e928ad36af46d7d152f45fbe8b73fa4d57d
- SHA512 bf49177d0e1e5aee0dda82f8242f446520fa9a0f1949215b294760ecd82ac2133561f5f7dd20a09a95aa5c09d8a1495a9a0469a8bc126c55efcca2b46aeea766
- SSDEEP 12288:LZ5zraThq5dDnHEJt1kX2wBhvBJ/+GIISY1ASu:LZ5n2hsdDnkGXFBhvn/++1Vu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 31KB
- SHA256 0ea4c8591aa480a4661a105fc6e3f3843ffa6f6b806caed19ee88cc05d87aa12
- MD5 d9d6f5faf6a8e7201aa5a97fb6f4c7bd
- SHA1 8e672e1751d5601bb0efa608599b1d2f6282b762
- SHA512 ff223d4722c82f281dfb1cef90f30d1606734b56b2951047a0737d1cbb96ae13437c27b70773bbcd548eb79be8346da0fb35da599b28d1704fc273f3637b8814
- SSDEEP 384:CVPg8UfR2xkqd4ypPMck2NLJ5RWzoUL7YAGsF3s4kBdftogn633u8MMv2KiZwB7F:JPfYFPMcjbEoUPS/ftWPMQywn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 574KB
- SHA256 415be033b4932638d8eb6a0070b1a79da5c1aa0f1fa282dab929e85d1f42f387
- MD5 34803203d25500f52ca158a438a0d907
- SHA1 b097f2a4ff4077529f64ba10400b2b4f775ea6fa
- SHA512 4f86f791259053de84ba229d07127696ab9995da9936070e83959e94fab2ca126cc0a9dd47371f30961e03b2380b05bd9d99ff558cbe2a4e38e9b2eda5e3406c
- SSDEEP 12288:8wpfrYJchDADAn1GXdB1E/ouTnhxSy6U81aeSM1c0qEaT:vYG1cBu/XYSkSEaT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.1MB
- SHA256 cc46d8ec308738a45b7ee864367039d60e2b8ab7bf6627e5e6a716ce1d27fa7d
- MD5 df5a68178162180029f3dd2a0508f070
- SHA1 6f347610eb96c7a0b7fbb478621dedf2eac30d84
- SHA512 1305de0645b4c11081cb622c7b2d34aa275db35f8ed896e182db0c58fdac4416a2796c6ee9225326142232cb2a5783a4b074a24e5ad96a91f3141e13a3a65cb8
- SSDEEP 49152:Wlh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlCzt5JSXeBdH370:WMgZeD+h3zJ7Bpr0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~1625543005910267564~\sg.tmp
- Size 715KB
- SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
- MD5 7c4718943bd3f66ebdb47ccca72c7b1e
- SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
- SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
- SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~6611156299854263070.tmp
- Size 3.2MB
- SHA256 c81bfc0c51683b64113b8df8d879e9b9257a3d9692e3c207c1f9c6835c915403
- MD5 bd4918530a56e1e0a3f017a4e60bfcba
- SHA1 eb24eb9425ae409410f20fda971354d80b7d97d4
- SHA512 15ce15a72d1d721edef725416caa2a97e2155edcd4635198a27c4bec5ba3ae70287a3d74957fd72c0716652f58e65060eb740d39ece85428f0c0afce9967d5f2
- SSDEEP 98304:TrGZi8sCUvnfq6VIFijV78qQrec2IB3eKYShGfuj8:Tei8sCUvnfqYyrUIB3eKDgmY
- MD5 SHA1 SHA512 SSDEEP