cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KitchenCanvas.exe
Size 3.6MB
Sample260417-phb66sdv9m
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	KitchenCanvas.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\License.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExt.dll	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Default.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\7zxa.dll	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Rar.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Descript.ion	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Rar.exe	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Order.htm	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Default32.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Zip.SFX	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240667437	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\Resources.pri	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	KitchenCanvas.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	KitchenCanvas.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe

Executes dropped EXE 15 IoCs

pid	Process
2112	uninstall.exe
4164	WinRAR.exe
4372	WinRAR.exe
4292	WinRAR.exe
1884	WinRAR.exe
3032	WinRAR.exe
2224	WinRAR.exe
5932	WinRAR.exe
4136	WinRAR.exe
4432	WinRAR.exe
4556	WinRAR.exe
4756	WinRAR.exe
2692	WinRAR.exe
5860	WinRAR.exe
5524	WinRAR.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.001	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe

Suspicious behavior: GetForegroundWindowSpam 11 IoCs

pid	Process
4164	WinRAR.exe
4372	WinRAR.exe
4292	WinRAR.exe
1884	WinRAR.exe
2224	WinRAR.exe
4136	WinRAR.exe
4556	WinRAR.exe
4756	WinRAR.exe
2692	WinRAR.exe
5860	WinRAR.exe
5524	WinRAR.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4728	KitchenCanvas.exe
4728	KitchenCanvas.exe
2112	uninstall.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2112	4728	KitchenCanvas.exe	90

C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe
"C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2112

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:868

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4164

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5460

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3892

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4292

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5116

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1884

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5160

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2304

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2224

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1632

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4024

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5376

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:6008

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4556

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4268

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4936

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5492

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5860

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3372

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\Program Files\WinRAR\Rar.exe
Size 816KB
SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
MD5 5b4a409a41c0032ba0070d35919655c3
SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
TLSH
T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 218KB
SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
MD5 4a59876cc56186ebb4e7ebc080b57264
SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
TLSH
T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnRAR.exe

Path C:\Program Files\WinRAR\UnRAR.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 949db1a8ae3d6f76a3db20505b8818851836780f47a6d5f786c58607e2353928
MD5 cb67d4dae3df02823bb29f4c550034e2
SHA1 b6d3940e01dcf382102f6c27a761ac6813b06e4f
SHA512 1744aaeae0b392cbe9892bd4fcc941f72e2843c5ad8b23793f30d600fe4e0918f86f64f0851d46a915e8134eb8c92d39b2ea31c1aad63448dd66ea64761926af
MD5 SHA1 SHA512

Submit Download

memory/868-89-0x000001A8CBB50000-0x000001A8CBBEE000-memory.dmp

Download

memory/1632-128-0x0000012BE4760000-0x0000012BE47FE000-memory.dmp

Download

memory/1884-105-0x00000274CA740000-0x00000274CA7DE000-memory.dmp

Download

memory/1884-133-0x00000274CA740000-0x00000274CA7DE000-memory.dmp

Download

memory/2224-121-0x000001FBBB640000-0x000001FBBB6DE000-memory.dmp

Download

memory/2224-158-0x000001FBBB640000-0x000001FBBB6DE000-memory.dmp

Download

memory/2304-120-0x000001E02AE00000-0x000001E02AE9E000-memory.dmp

Download

memory/2692-206-0x0000025636CA0000-0x0000025636D3E000-memory.dmp

Download

memory/2692-290-0x0000025636CA0000-0x0000025636D3E000-memory.dmp

Download

memory/3032-141-0x000001D97E550000-0x000001D97E5EE000-memory.dmp

Download

memory/3032-110-0x000001D97E550000-0x000001D97E5EE000-memory.dmp

Download

memory/3372-244-0x00000249A7E50000-0x00000249A7EEE000-memory.dmp

Download

memory/3892-97-0x0000017CDBA00000-0x0000017CDBA9E000-memory.dmp

Download

memory/4024-142-0x00000252B2DD0000-0x00000252B2E6E000-memory.dmp

Download

memory/4136-211-0x0000011545040000-0x00000115450DE000-memory.dmp

Download

memory/4136-143-0x0000011545040000-0x00000115450DE000-memory.dmp

Download

memory/4164-115-0x0000020C46B30000-0x0000020C46BCE000-memory.dmp

Download

memory/4164-90-0x0000020C46B30000-0x0000020C46BCE000-memory.dmp

Download

memory/4268-185-0x000001A2C4E00000-0x000001A2C4E9E000-memory.dmp

Download

memory/4292-98-0x000001E912CB0000-0x000001E912D4E000-memory.dmp

Download

memory/4292-136-0x000001E912CB0000-0x000001E912D4E000-memory.dmp

Download

memory/4372-93-0x000001F6662D0000-0x000001F66636E000-memory.dmp

Download

memory/4372-112-0x000001F6662D0000-0x000001F66636E000-memory.dmp

Download

memory/4432-154-0x000001FD687E0000-0x000001FD6887E000-memory.dmp

Download

memory/4432-204-0x000001FD687E0000-0x000001FD6887E000-memory.dmp

Download

memory/4556-251-0x000002424C710000-0x000002424C7AE000-memory.dmp

Download

memory/4556-172-0x000002424C710000-0x000002424C7AE000-memory.dmp

Download

memory/4756-243-0x00000238F7290000-0x00000238F732E000-memory.dmp

Download

memory/4756-186-0x00000238F7290000-0x00000238F732E000-memory.dmp

Download

memory/4936-205-0x000002156BEB0000-0x000002156BF4E000-memory.dmp

Download

memory/5116-104-0x000001E1C9B20000-0x000001E1C9BBE000-memory.dmp

Download

memory/5160-109-0x000001D503FD0000-0x000001D50406E000-memory.dmp

Download

memory/5376-153-0x0000026694CD0000-0x0000026694D6E000-memory.dmp

Download

memory/5460-92-0x0000013B3B010000-0x0000013B3B0AE000-memory.dmp

Download

memory/5492-221-0x000001E5F9780000-0x000001E5F981E000-memory.dmp

Download

memory/5524-245-0x000002128CEF0000-0x000002128CF8E000-memory.dmp

Download

memory/5524-304-0x000002128CEF0000-0x000002128CF8E000-memory.dmp

Download

memory/5860-222-0x000001A02F000000-0x000001A02F09E000-memory.dmp

Download

memory/5860-283-0x000001A02F000000-0x000001A02F09E000-memory.dmp

Download

memory/5932-129-0x000001E67D7B0000-0x000001E67D84E000-memory.dmp

Download

memory/5932-170-0x000001E67D7B0000-0x000001E67D84E000-memory.dmp

Download

memory/6008-171-0x000001C857610000-0x000001C8576AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads