Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
KitchenCanvas.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
KitchenCanvas.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target KitchenCanvas.exe
- Size 3.6MB
- Sample260417-phb66sdv9m
- SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
- MD5 273fd2329712084f98f4ba825b8f7cec
- SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
- SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
- SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
- TLSH T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WinRAR\RarExtInstaller.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\WinRAR.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR KitchenCanvas.exe File created C:\Program Files\WinRAR\License.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\Rar.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtPackage.msix KitchenCanvas.exe File created C:\Program Files\WinRAR\Resources.pri KitchenCanvas.exe File created C:\Program Files\WinRAR\WinCon32.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Descript.ion KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinCon32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\WhatsNew.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExt32.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\Default.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png KitchenCanvas.exe File created C:\Program Files\WinRAR\WinRAR.chm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Rar.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExt.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png KitchenCanvas.exe File created C:\Program Files\WinRAR\Descript.ion KitchenCanvas.exe File created C:\Program Files\WinRAR\Uninstall.lst KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Resources.pri KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240667796 KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Rar.txt KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\Zip.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Order.htm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\7zxa.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Default.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\UnRAR.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png KitchenCanvas.exe File created C:\Program Files\WinRAR\Uninstall.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\Order.htm KitchenCanvas.exe File created C:\Program Files\WinRAR\ReadMe.txt KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\License.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\RarFiles.lst KitchenCanvas.exe File created C:\Program Files\WinRAR\Rar.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\Zip32.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\Default32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\WinCon.SFX KitchenCanvas.exe - Executes dropped EXE 20 IoCs
pid Process 4072 uninstall.exe 1948 RarExtInstaller.exe 5164 WinRAR.exe 5632 RarExtInstaller.exe 3784 WinRAR.exe 6088 WinRAR.exe 1420 WinRAR.exe 2524 WinRAR.exe 1696 RarExtInstaller.exe 4728 RarExtInstaller.exe 3300 WinRAR.exe 720 RarExtInstaller.exe 5464 WinRAR.exe 5884 WinRAR.exe 464 WinRAR.exe 4648 WinRAR.exe 3140 WinRAR.exe 4620 WinRAR.exe 4220 WinRAR.exe 5936 WinRAR.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1" uninstall.exe - Suspicious behavior: GetForegroundWindowSpam 12 IoCs
pid Process 5164 WinRAR.exe 3784 WinRAR.exe 6088 WinRAR.exe 1420 WinRAR.exe 2524 WinRAR.exe 3300 WinRAR.exe 5884 WinRAR.exe 4648 WinRAR.exe 3140 WinRAR.exe 4620 WinRAR.exe 4220 WinRAR.exe 5936 WinRAR.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4320 KitchenCanvas.exe 4320 KitchenCanvas.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4072 4320 KitchenCanvas.exe 79 PID 4072 wrote to memory of 1948 4072 uninstall.exe 80 PID 5164 wrote to memory of 5632 5164 WinRAR.exe 84 PID 2524 wrote to memory of 1696 2524 WinRAR.exe 94 PID 3300 wrote to memory of 720 3300 WinRAR.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe"C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
PID:1948
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5392
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:5632
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3948
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3784
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1520
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6088
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5400
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1420
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5972
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
PID:4728
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:2076
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:720
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1600
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
PID:5464
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1872
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:5884
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:2432
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:464
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:404
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4648
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:788
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3140
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5080
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4620
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3144
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4220
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4224
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:5936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.exe
- Size 816KB
- SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
- MD5 5b4a409a41c0032ba0070d35919655c3
- SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
- SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
- SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
- TLSH T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Rar.txt
- Size 110KB
- SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
- MD5 9a08ebded98c1260436a21869e80b1d9
- SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
- SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
- SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
- TLSH T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 218KB
- SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
- MD5 4a59876cc56186ebb4e7ebc080b57264
- SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
- SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
- SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
- TLSH T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
- MD5 85b4bbcd102e0d0c655b72096ab48405
- SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
- SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
- SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
- TLSH T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 402KB
- SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
- MD5 a49476fbc8efa147bec8df78b46e1d52
- SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
- SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
- SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
- TLSH T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 61KB
- SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
- MD5 18c37699b070b94831c300cf15c4fca6
- SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
- SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
- SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
- TLSH T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 321KB
- SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
- MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
- SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
- SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
- SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
- TLSH T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.3MB
- SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
- MD5 1332606c405863d514138396940d03b8
- SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
- SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
- SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
- TLSH T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 727B
- SHA256 5a786ced33a42a4d09927b0789faa67019fe4f991e2ebbad785dbc9b6243a535
- MD5 fd11ea1860c347ab3a50de9e4a687070
- SHA1 d12f2e1706c63329c4d0663dec0fb043099ad218
- SHA512 f3a78388bf0db29e69d1aff9a87509b7985dea9400d77bae685c06732e320d313be0e342651c2678097fba35d2d7c7ad3ce9a972f8a52fe48d968327872f1ccd
- TLSH T14101D80218ABD1092D428F0976AECB367842037BCCB5544E2B306691D08D6514C23968
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 d438abb946c354f9bcd3dfb5df7689bf730a40efd7c70cc71f82c598242887aa
- MD5 57e58dd60bea54ceef6ae2d324a3c8f8
- SHA1 59560fb7cfeb35bc38d2d1ed6e7353def92e3d29
- SHA512 422fbba082a7963394f46bf27ba12d4c6acb5bf6b63efb234351096d80464f9bfea924e114fb71f541d0e7fe68124c8bd0e2090cedcf3bfaa56a5e2a1dbbc465
- TLSH T1D6011547B838562175265C12D7AC56F5F17BC5452089839974F0264704AF3F9DE1B099
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 a4614c1cd83a58c64a2f506fb29abbd7dbcda940391d831085c99d0020a2e8fc
- MD5 7c853f9f0edaf85b7e92420ed7b34866
- SHA1 97f7df781e11b454d63406a8fbe04a99adf918eb
- SHA512 ad721544e510ec4559f4164b1fc53259cc9471c5d1b05cb0dc911ab23ecc7d7d5bc31d38b79e31ced7fabe3495f90a1f8a2176390dd7988c76be86903e349f90
- TLSH T158E05E112BE84205F9770E3CAC7366499977B76B6A51CADD0275008D1C21FA2CD32B1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 404B
- SHA256 5451d2fe41c1d0d28c2d13f8071318a9f69b2df55ba2fe7ed829a258142eeda4
- MD5 9eb18aa12738896336ef18065a6f7bc2
- SHA1 2256c0979da4f2ed49f88e8e8d0f843f0a97e6ef
- SHA512 c83d99cd63a834a5c5b53f4fac8686aa7e9491c7c2f2e1be9c0649d3849937dcab075369e8e432282e7e31809ba378c873d5d66c86e8c2eaa3ad6db8aace8481
- TLSH T183E0263822FB599DF4F5D87406F69E214BAAF2920552C3AD11D0AB4BAE15B808CD1A28
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 fff21f428580de2b23743ee70bbe011c443d95fdacb4d24f6ff16ed31be1df72
- MD5 552f4edaad81e5ad363f68bdf851b8ea
- SHA1 7e58e094ebc25a25338c6b5f612d18622e6ed9d3
- SHA512 83e15617eaa3a06afeb7065cefafd8b027a68ef94c5d3888d6316af71342983796fe91ae05620274fd05ccaf5f4105344d249c16c8f1bb315c18ed797802b963
- TLSH T1ECE06F2826EBF00EF0909C3686FAB1760E48E2022080A2B820844348BB0AE005D18AF4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
- Size 12B
- SHA256 fe0e31d134684461c84b60245753fa5d4a08c0d2a6dbccc042d76127934d93c3
- MD5 49cf70d2daf05c6861bec73fc7d684fe
- SHA1 64d3e52166b4514cdc1b714d7e3e4ec713cc576c
- SHA512 4eecee1c661bb555818c54149f7b4fd016280c5480aa1dc5e3284c18510700dd0f64568c7183a8c92ad5f99826c11582a3d6d5e1583d421b78b9312e33ee5589
- MD5 SHA1 SHA512