Overview

overview

7

Static

static

3

UpdaterSoft.exe

windows7-x64

1

UpdaterSoft.exe

windows10-2004-x64

3

locales/wi...01.exe

windows7-x64

5

locales/wi...01.exe

windows10-2004-x64

1

python3.dll

windows7-x64

1

python3.dll

windows10-2004-x64

1

python312.dll

windows7-x64

3

python312.dll

windows10-2004-x64

3

updater/py...64.exe

windows7-x64

7

updater/py...64.exe

windows10-2004-x64

7

vcruntime140.dll

windows7-x64

3

vcruntime140.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    124s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2024 03:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    locales/winrar-x64-701.exe

  • Size

    3.8MB

  • MD5

    46c17c999744470b689331f41eab7df1

  • SHA1

    b8a63127df6a87d333061c622220d6d70ed80f7c

  • SHA256

    c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

  • SHA512

    4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

  • SSDEEP

    98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB

Score
5/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\locales\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\locales\winrar-x64-701.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        3⤵
          PID:1408
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:1836
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2952
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          3⤵
            PID:544
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1652
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
            3⤵
              PID:928
            • C:\Program Files\WinRAR\WinRAR.exe
              "C:\Program Files\WinRAR\WinRAR.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2200
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
              3⤵
                PID:2040
              • C:\Program Files\WinRAR\WinRAR.exe
                "C:\Program Files\WinRAR\WinRAR.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2404
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                3⤵
                  PID:2344
                • C:\Program Files\WinRAR\WinRAR.exe
                  "C:\Program Files\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1560
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                  3⤵
                    PID:1588
                  • C:\Program Files\WinRAR\WinRAR.exe
                    "C:\Program Files\WinRAR\WinRAR.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2352
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                    3⤵
                      PID:1752
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                      3⤵
                        PID:2712
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2692
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1428
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                        3⤵
                          PID:2596
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3048
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                          3⤵
                            PID:1316
                          • C:\Program Files\WinRAR\WinRAR.exe
                            "C:\Program Files\WinRAR\WinRAR.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:704
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                            3⤵
                              PID:592
                            • C:\Program Files\WinRAR\WinRAR.exe
                              "C:\Program Files\WinRAR\WinRAR.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1088
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                              3⤵
                                PID:2316
                              • C:\Program Files\WinRAR\WinRAR.exe
                                "C:\Program Files\WinRAR\WinRAR.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2680
                              • C:\Windows\system32\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                3⤵
                                  PID:1556
                                • C:\Program Files\WinRAR\WinRAR.exe
                                  "C:\Program Files\WinRAR\WinRAR.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:372
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                  3⤵
                                    PID:2828
                                  • C:\Program Files\WinRAR\WinRAR.exe
                                    "C:\Program Files\WinRAR\WinRAR.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:2060
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                    3⤵
                                      PID:1572
                                    • C:\Program Files\WinRAR\WinRAR.exe
                                      "C:\Program Files\WinRAR\WinRAR.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      PID:2500
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                      3⤵
                                        PID:1880

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\WinRAR\Order.htm
                                    Filesize

                                    3KB

                                    MD5

                                    5c336de3b3d794322ad9e5915e3a509f

                                    SHA1

                                    5256262a417e9a29fe23e8cca09782c7a3532fc9

                                    SHA256

                                    bce29ef3b95306cb7b304fb8c3039be7157356d9f9d4e7e1c6bfbf02a117f48f

                                    SHA512

                                    7243c9b8eb39fc8aa10ec8b5c290e27d44fa1c245f0478b75ae77964c178d41e9c1f651f987316f1153c1a7176eecebc269ffb0c42ced5bd0b12e5cc1b95da04

                                    Download Submit

                                  • C:\Program Files\WinRAR\Rar.txt
                                    Filesize

                                    105KB

                                    MD5

                                    b954981a253f5e1ee25585037a0c5fee

                                    SHA1

                                    96566e5c591df1c740519371ee6953ac1dc6a13f

                                    SHA256

                                    59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

                                    SHA512

                                    6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

                                    Download Submit

                                  • C:\Program Files\WinRAR\WhatsNew.txt
                                    Filesize

                                    45KB

                                    MD5

                                    1c44c85fdab8e9c663405cd8e4c3dbbd

                                    SHA1

                                    74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

                                    SHA256

                                    33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

                                    SHA512

                                    46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

                                    Download Submit

                                  • C:\Program Files\WinRAR\WinRAR.chm
                                    Filesize

                                    316KB

                                    MD5

                                    6ca1bc8bfe8b929f448e1742dacb8e7f

                                    SHA1

                                    eca3e637db230fa179dcd6c6499bd7d616f211e8

                                    SHA256

                                    997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

                                    SHA512

                                    d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

                                    Download Submit

                                  • C:\Program Files\WinRAR\WinRAR.exe
                                    Filesize

                                    3.1MB

                                    MD5

                                    53cf9bacc49c034e9e947d75ffab9224

                                    SHA1

                                    7db940c68d5d351e4948f26425cd9aee09b49b3f

                                    SHA256

                                    3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3

                                    SHA512

                                    44c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                                    Filesize

                                    12B

                                    MD5

                                    1bb20ffd821bd5a20218f54af685a4e0

                                    SHA1

                                    7f2106a11d6715066badcfbe1023e11c8a442739

                                    SHA256

                                    06edf502a96ccd1f57dbe65d3c45ab9cdb0d281a974b2a84310f2d99c6c5013f

                                    SHA512

                                    18c971db9226d92651ee988cf097183cdb0225ba81831b37fbc1221bb7d247816dcdc15cf3ad357156282b661dedb19c9f9413cf74888f6970d3eb2832c0976e

                                    Download Submit

                                  • \Program Files\WinRAR\Rar.exe
                                    Filesize

                                    744KB

                                    MD5

                                    16659ae52ce03889ad19db1f5710c6aa

                                    SHA1

                                    66b814fe3be64229e2cc19f0a4460e123ba74971

                                    SHA256

                                    0b1866b627d8078d296e7d39583c9f856117be79c1d226b8c9378fe075369118

                                    SHA512

                                    f9dd360c3a230131c08c4d5f838457f690ed4094ec166acd9f141b7603f649cfa71a47ea80e9ff41b8296246bdc1c72a75288f9a836c18431e06c2e8e3fc8398

                                    Download Submit

                                  • \Program Files\WinRAR\RarExtInstaller.exe
                                    Filesize

                                    181KB

                                    MD5

                                    f5b54d16610a819bbc6099bdc92add2c

                                    SHA1

                                    7c680a87233ff7e75866657e9c1acf97d69f6579

                                    SHA256

                                    46f533007fb231d0b0af058a0997ab5e6b44a1b02ae327621f04fdc4b2e18964

                                    SHA512

                                    a120a2ee6c926cd6f6b8d1be68ff471294552b049baa637a474d1210fe3ca83e66d0834217d1a5eea0491d080cea1795ee328fdd4cb54f6a132be2dc2e58e4a8

                                    Download Submit

                                  • \Program Files\WinRAR\Uninstall.exe
                                    Filesize

                                    477KB

                                    MD5

                                    4783f1a5f0bba7a6a40cb74bc8c41217

                                    SHA1

                                    a22b9dc8074296841a5a78ea41f0e2270f7b7ad7

                                    SHA256

                                    f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c

                                    SHA512

                                    463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e

                                    Download Submit