Overview

overview

10

Static

static

3

Lang/lang-1049.dll

windows7-x64

1

Lang/lang-1049.dll

windows10-2004-x64

1

Lang/lang-1058.dll

windows7-x64

1

Lang/lang-1058.dll

windows10-2004-x64

1

avcodec-58.dll

windows7-x64

1

avcodec-58.dll

windows10-2004-x64

1

installer_....1.exe

windows7-x64

10

installer_....1.exe

windows10-2004-x64

10

opengl32sw.dll

windows7-x64

1

opengl32sw.dll

windows10-2004-x64

1

vcruntime140.dll

windows7-x64

1

vcruntime140.dll

windows10-2004-x64

1

winrar-x64.exe

windows7-x64

5

winrar-x64.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    126s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-01-2025 18:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    winrar-x64.exe

  • Size

    3.6MB

  • MD5

    517023aad9ad2f3200057ce0b704e196

  • SHA1

    7612058b5f0f87327b2957d5da63a2c6e65b0ea1

  • SHA256

    de1d9040786c80f3f40f41c98aa1f6b14fc7b6f2d3db09eceadd340327164f8e

  • SHA512

    bef1b7268d8c2c1f6c900fe392ecf11d2cd518dfa9944fb77c29c2306d20d89052a39c45d689054173ce866be1e93d4b3097131a120cd7567092527e1f50b3e1

  • SSDEEP

    98304:vABAG9dn8V6e3yfnjvg6Tuq1LA28xv12m2ERCHo:va9dXh6q1Lf8xv5tCI

Score
5/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        3⤵
          PID:2900
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:1428
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
          3⤵
            PID:2596
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3020
          • C:\Program Files\WinRAR\WinRAR.exe
            "C:\Program Files\WinRAR\WinRAR.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1412
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
            3⤵
              PID:2024
            • C:\Program Files\WinRAR\WinRAR.exe
              "C:\Program Files\WinRAR\WinRAR.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:772
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
              3⤵
                PID:2104
              • C:\Program Files\WinRAR\WinRAR.exe
                "C:\Program Files\WinRAR\WinRAR.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1620
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                3⤵
                  PID:2080
                • C:\Program Files\WinRAR\WinRAR.exe
                  "C:\Program Files\WinRAR\WinRAR.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:308
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                  3⤵
                    PID:1764
                  • C:\Program Files\WinRAR\WinRAR.exe
                    "C:\Program Files\WinRAR\WinRAR.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2320
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                    3⤵
                      PID:2380
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                      3⤵
                        PID:2768
                      • C:\Program Files\WinRAR\WinRAR.exe
                        "C:\Program Files\WinRAR\WinRAR.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2720
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                        3⤵
                          PID:2652
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2784
                        • C:\Program Files\WinRAR\WinRAR.exe
                          "C:\Program Files\WinRAR\WinRAR.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2616
                        • C:\Windows\system32\NOTEPAD.EXE
                          "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                          3⤵
                            PID:2620
                          • C:\Program Files\WinRAR\WinRAR.exe
                            "C:\Program Files\WinRAR\WinRAR.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2648
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                            3⤵
                              PID:2736
                            • C:\Program Files\WinRAR\WinRAR.exe
                              "C:\Program Files\WinRAR\WinRAR.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2960
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                              3⤵
                                PID:2968
                              • C:\Program Files\WinRAR\WinRAR.exe
                                "C:\Program Files\WinRAR\WinRAR.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1536
                              • C:\Windows\system32\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                3⤵
                                  PID:2932
                                • C:\Program Files\WinRAR\WinRAR.exe
                                  "C:\Program Files\WinRAR\WinRAR.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2076
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                  3⤵
                                    PID:1388
                                  • C:\Program Files\WinRAR\WinRAR.exe
                                    "C:\Program Files\WinRAR\WinRAR.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:1696
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                    3⤵
                                      PID:1324
                                    • C:\Windows\system32\NOTEPAD.EXE
                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
                                      3⤵
                                        PID:3008
                                      • C:\Program Files\WinRAR\WinRAR.exe
                                        "C:\Program Files\WinRAR\WinRAR.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        PID:2340

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files\WinRAR\Order.htm
                                    Filesize

                                    3KB

                                    MD5

                                    1310b652e7362a994650ee9278424101

                                    SHA1

                                    b81dbbd0446891eaccfd03caf91f927c23248363

                                    SHA256

                                    0365aac5c65889c7533dcd3f239e8491fedfa9ef01b9ea1c91a5ef535172589f

                                    SHA512

                                    568f078b614432c018a3aff40051f60facbf741199988b860a1215e8fc9e27c2fe968e67bcc496a91e6f246ce9bd89995f8e47ee166c200cfcef57e85d2e50d2

                                    Download Submit

                                  • C:\Program Files\WinRAR\Rar.exe
                                    Filesize

                                    768KB

                                    MD5

                                    32105a78abe923b50a601cb5bab6419a

                                    SHA1

                                    f59828e053798d581389320d26a1eadd800183bc

                                    SHA256

                                    4ff3d788385f89b3685d6b234100c72ee327ffc1aa94d13625eb9e92787ecee4

                                    SHA512

                                    6cdcc790b63118b4ca20cbe8ce06e68c0723a05e08f42f2ba727ce253c0e9bcbc6c2bee47eb37b203c019118d5e2e3bc14019693b177e13996c46ae7ac0725fe

                                    Download Submit

                                  • C:\Program Files\WinRAR\Rar.txt
                                    Filesize

                                    109KB

                                    MD5

                                    2132aceded754d35ab911823a9b41cb4

                                    SHA1

                                    e1f549ae718257f55b61bedfd0e7b9c06dc3f533

                                    SHA256

                                    6805c8b3fa7d4f19dbd2439e2cdbf2cf7c6e538484d800266798575a58571b70

                                    SHA512

                                    464142af80cd292f2558af5d1d133b27df611999322772bc4e442eb4f7bb6b7b3e7fa8dd26cc050abcbcc6d205e4298f81ea948bbe1ca12c3e126cc960cf3478

                                    Download Submit

                                  • C:\Program Files\WinRAR\WhatsNew.txt
                                    Filesize

                                    50KB

                                    MD5

                                    35bd214434c43c5d02b2be9d59a6a496

                                    SHA1

                                    8751490f7159ccce1a37b337824b35378c7ede63

                                    SHA256

                                    3458c5f059146fd519e95b01397bc063c02c618b962d1ea1034989983f4d6317

                                    SHA512

                                    565fe00206b80fe9ff59a89e9f7b373e93454eb2a1e80b9a02e75a6575f04915d359f54654e172bdcf0351544b1c02f87dc6e2f1e69a0d769866aeade2630086

                                    Download Submit

                                  • C:\Program Files\WinRAR\WinRAR.chm
                                    Filesize

                                    323KB

                                    MD5

                                    53ad0a4d91e4382adfbb7a32586b0268

                                    SHA1

                                    d66cf7e028ef6c7b4361cd58bd6ce73bc62557aa

                                    SHA256

                                    af036a8fc3d84838ad5dab142a5f4dd6e939a083d1af9371af3ef3ae5428fd31

                                    SHA512

                                    352bb33a00d19f0310d31cfc26f66cfdb4bcdb24127f28384e1eaf9ac0b02a06d403a86e519894054e42bd6a9167536b1cff77ea27c6cced275860021e0ba943

                                    Download Submit

                                  • C:\Program Files\WinRAR\WinRAR.exe
                                    Filesize

                                    3.2MB

                                    MD5

                                    d0b13a4155900291fffc4199d7a00173

                                    SHA1

                                    e238bc74de42670c3bbe9d0d317d07647d9389d0

                                    SHA256

                                    72a2899a23ee78bc8059ecbf81cfdc1003a401e460ece5bbf54a47a3cd392b8c

                                    SHA512

                                    41973232528fc09407aba3000fb433c7f9855b63ee83f4a20faf9bfb7554e2f0cf894f9350b7531d620bca67856728c6e39c7ad4b2bff2b0357d14991e3e448e

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
                                    Filesize

                                    12B

                                    MD5

                                    58717e9b37c9fc2aca12f7c1656ec036

                                    SHA1

                                    6d5928b8c69634bd2b38a5e400047bb1eb19fbdf

                                    SHA256

                                    a673df27689e6dfdd23687646b8b84403cef998cd1da8831686f02a6792ff643

                                    SHA512

                                    3c307a345fe5b8d650d2b878ec799e165c015c6894e533d90778ccbaff18a16827b8e83920c686b176c78589307feab026ec6ac055aed278a58676b309164ef4

                                    Download Submit

                                  • \Program Files\WinRAR\RarExtInstaller.exe
                                    Filesize

                                    183KB

                                    MD5

                                    d1188336c3a61044434a7fff6aef2a2a

                                    SHA1

                                    51feb7c70458274ee7cf54d4ba19ae60b9aba627

                                    SHA256

                                    09da767371614712debc66c5136acf9fc107598e595e83e3958a8ed4c7ad04a5

                                    SHA512

                                    3cf25e5dc4317402665f7f832c7f18d823a2448aefbe924bc448994861b1ed60818a85e3a7b4bac6124ea0928b89f9ce24ebaed3132323e1a567dd43115809a6

                                    Download Submit

                                  • \Program Files\WinRAR\Uninstall.exe
                                    Filesize

                                    383KB

                                    MD5

                                    33cecf93517f305d54609584a7d9e6bc

                                    SHA1

                                    5d816ed1ec543865646b78361b6f14fb0dafe33e

                                    SHA256

                                    288ec8500f2661a42ac531d5d7a9dc3d11d77885b3dc63ef2d3a7b75a210b5d1

                                    SHA512

                                    319ed031867f64c9312d8263ff5cdbd7e4c3ff77573224a4963b6ed5a1eac6ce52e607812742895ab996fb0d216daee34b00841b92f0bf6a5d56ff7efbe8a91c

                                    Download Submit