Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 17:17
Static task
static1
Behavioral task
behavioral1
Sample
ee/src.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ee/src.exe
Resource
win10v2004-20241007-en
General
-
Target
ee/src.exe
-
Size
3.8MB
-
MD5
46c17c999744470b689331f41eab7df1
-
SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c
-
SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
-
SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
-
SSDEEP
98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 60 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png src.exe File created C:\Program Files\WinRAR\RarExt.dll src.exe File created C:\Program Files\WinRAR\Default32.SFX src.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX src.exe File created C:\Program Files\WinRAR\Zip32.SFX src.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX src.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst src.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll src.exe File created C:\Program Files\WinRAR\WinCon.SFX src.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX src.exe File created C:\Program Files\WinRAR\Uninstall.exe src.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll src.exe File created C:\Program Files\WinRAR\Resources.pri src.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png src.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\License.txt src.exe File opened for modification C:\Program Files\WinRAR\License.txt src.exe File created C:\Program Files\WinRAR\Order.htm src.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png src.exe File created C:\Program Files\WinRAR\Uninstall.lst src.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe src.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png src.exe File opened for modification C:\Program Files\WinRAR\Rar.txt src.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe src.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll src.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png src.exe File opened for modification C:\Program Files\WinRAR src.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259457243 src.exe File created C:\Program Files\WinRAR\WhatsNew.txt src.exe File opened for modification C:\Program Files\WinRAR\Resources.pri src.exe File created C:\Program Files\WinRAR\Zip.SFX src.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png src.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm src.exe File opened for modification C:\Program Files\WinRAR\Descript.ion src.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt src.exe File created C:\Program Files\WinRAR\Rar.exe src.exe File created C:\Program Files\WinRAR\WinRAR.exe src.exe File created C:\Program Files\WinRAR\Descript.ion src.exe File created C:\Program Files\WinRAR\ReadMe.txt src.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix src.exe File created C:\Program Files\WinRAR\7zxa.dll src.exe File opened for modification C:\Program Files\WinRAR\Default.SFX src.exe File opened for modification C:\Program Files\WinRAR\WinCon32.SFX src.exe File created C:\Program Files\WinRAR\RarFiles.lst src.exe File created C:\Program Files\WinRAR\UnRAR.exe src.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe src.exe File created C:\Program Files\WinRAR\RarExt32.dll src.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX src.exe File created C:\Program Files\WinRAR\WinRAR.chm src.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt src.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst src.exe File opened for modification C:\Program Files\WinRAR\Rar.exe src.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe src.exe File created C:\Program Files\WinRAR\Rar.txt src.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe src.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\Order.htm src.exe File created C:\Program Files\WinRAR\RarExtPackage.msix src.exe File created C:\Program Files\WinRAR\Default.SFX src.exe File created C:\Program Files\WinRAR\WinCon32.SFX src.exe -
Executes dropped EXE 1 IoCs
pid Process 2528 uninstall.exe -
Loads dropped DLL 8 IoCs
pid Process 2404 src.exe 1184 Process not Found 1184 Process not Found 2528 uninstall.exe 1184 Process not Found 2528 uninstall.exe 1184 Process not Found 1184 Process not Found -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main src.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2404 src.exe 2404 src.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2528 2404 src.exe 31 PID 2404 wrote to memory of 2528 2404 src.exe 31 PID 2404 wrote to memory of 2528 2404 src.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee\src.exe"C:\Users\Admin\AppData\Local\Temp\ee\src.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:2528
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5b954981a253f5e1ee25585037a0c5fee
SHA196566e5c591df1c740519371ee6953ac1dc6a13f
SHA25659e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd
SHA5126a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531
-
Filesize
45KB
MD51c44c85fdab8e9c663405cd8e4c3dbbd
SHA174d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88
SHA25633108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d
SHA51246d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d
-
Filesize
316KB
MD56ca1bc8bfe8b929f448e1742dacb8e7f
SHA1eca3e637db230fa179dcd6c6499bd7d616f211e8
SHA256997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344
SHA512d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973
-
Filesize
3.1MB
MD553cf9bacc49c034e9e947d75ffab9224
SHA17db940c68d5d351e4948f26425cd9aee09b49b3f
SHA2563b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3
SHA51244c9154b1fdbcf27ab7faee6be5b563a18b2baead3e68b3ea788c6c76cf582f52f3f87bd447a4f6e25ec7d4690761332211659d754fb4e0630c22a372e470bda
-
Filesize
477KB
MD54783f1a5f0bba7a6a40cb74bc8c41217
SHA1a22b9dc8074296841a5a78ea41f0e2270f7b7ad7
SHA256f376aaa0d4444d0727db5598e8377f9f1606400adbbb4772d39d1e4937d5f28c
SHA512463dff17f06eca41ae76e3c0b2efc4ef36529aa2eaed5163eec0a912fe7802c9fb38c37acfe94b82972861aaf1acf02823a5948fbb3292bb4743641acb99841e