Overview

overview

5

Static

static

1

winrar-x64-701.exe

windows7-x64

5

winrar-x64-701.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2024, 22:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    winrar-x64-701.exe

  • Size

    3.8MB

  • MD5

    46c17c999744470b689331f41eab7df1

  • SHA1

    b8a63127df6a87d333061c622220d6d70ed80f7c

  • SHA256

    c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

  • SHA512

    4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

  • SSDEEP

    98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB

Score
5/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 23 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        3⤵
          PID:1148
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:2896
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1696
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          3⤵
            PID:1196
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: GetForegroundWindowSpam
            PID:1548
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
            3⤵
              PID:344

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\WinRAR\Order.htm
          Filesize

          3KB

          MD5

          5c336de3b3d794322ad9e5915e3a509f

          SHA1

          5256262a417e9a29fe23e8cca09782c7a3532fc9

          SHA256

          bce29ef3b95306cb7b304fb8c3039be7157356d9f9d4e7e1c6bfbf02a117f48f

          SHA512

          7243c9b8eb39fc8aa10ec8b5c290e27d44fa1c245f0478b75ae77964c178d41e9c1f651f987316f1153c1a7176eecebc269ffb0c42ced5bd0b12e5cc1b95da04

          Download Submit

        • C:\Program Files\WinRAR\Rar.txt
          Filesize

          105KB

          MD5

          b954981a253f5e1ee25585037a0c5fee

          SHA1

          96566e5c591df1c740519371ee6953ac1dc6a13f

          SHA256

          59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

          SHA512

          6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

          Download Submit

        • C:\Program Files\WinRAR\WhatsNew.txt
          Filesize

          45KB

          MD5

          1c44c85fdab8e9c663405cd8e4c3dbbd

          SHA1

          74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

          SHA256

          33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

          SHA512

          46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

          Download Submit

        • C:\Program Files\WinRAR\WinRAR.chm
          Filesize

          316KB

          MD5

          6ca1bc8bfe8b929f448e1742dacb8e7f

          SHA1

          eca3e637db230fa179dcd6c6499bd7d616f211e8

          SHA256

          997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

          SHA512

          d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

          Download Submit

        • C:\Program Files\WinRAR\WinRAR.exe
          Filesize

          3.1MB

          MD5

          53cf9bacc49c034e9e947d75ffab9224

          SHA1

          7db940c68d5d351e4948f26425cd9aee09b49b3f

          SHA256

          3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3

          SHA512

          44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda

          Download Submit

        • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
          Filesize

          12B

          MD5

          e8ddf55bb90b1307267cab63b8cb5f7b

          SHA1

          68740cc5289b527b3fe27e9f9b4d3b2a751972d8

          SHA256

          25b3c6223716d2a5dd31dd1c0e5f57d510ae7e408d331293001596c65f6fbe4c

          SHA512

          4e52d4475ddfef4820ce098d9fed57e9a6dadf7acfa7fa08825d54f16d9ef61531c91ba285e470aeb4f64df5b68ece88d76c0f335b217e6308326c92fb762896

          Download Submit

        • \Program Files\WinRAR\Rar.exe
          Filesize

          744KB

          MD5

          16659ae52ce03889ad19db1f5710c6aa

          SHA1

          66b814fe3be64229e2cc19f0a4460e123ba74971

          SHA256

          0b1866b627d8078d296e7d39583c9f856117be79c1d226b8c9378fe075369118

          SHA512

          f9dd360c3a230131c08c4d5f838457f690ed4094ec166acd9f141b7603f649cfa71a47ea80e9ff41b8296246bdc1c72a75288f9a836c18431e06c2e8e3fc8398

          Download Submit

        • \Program Files\WinRAR\RarExtInstaller.exe
          Filesize

          181KB

          MD5

          f5b54d16610a819bbc6099bdc92add2c

          SHA1

          7c680a87233ff7e75866657e9c1acf97d69f6579

          SHA256

          46f533007fb231d0b0af058a0997ab5e6b44a1b02ae327621f04fdc4b2e18964

          SHA512

          a120a2ee6c926cd6f6b8d1be68ff471294552b049baa637a474d1210fe3ca83e66d0834217d1a5eea0491d080cea1795ee328fdd4cb54f6a132be2dc2e58e4a8

          Download Submit

        • \Program Files\WinRAR\Uninstall.exe
          Filesize

          477KB

          MD5

          4783f1a5f0bba7a6a40cb74bc8c41217

          SHA1

          a22b9dc8074296841a5a78ea41f0e2270f7b7ad7

          SHA256

          f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c

          SHA512

          463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e

          Download Submit