cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06

Analysis

max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDFSnap.exe
Size 3.6MB
Sample260503-ws6l4ae16w
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\Default32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\Zip.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	PDFSnap.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Order.htm	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExt.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240648875	PDFSnap.exe
File created	C:\Program Files\WinRAR\Descript.ion	PDFSnap.exe
File created	C:\Program Files\WinRAR\License.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	PDFSnap.exe
File created	C:\Program Files\WinRAR\Rar.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	PDFSnap.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\7zxa.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	PDFSnap.exe
File created	C:\Program Files\WinRAR\Resources.pri	PDFSnap.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\Rar.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	PDFSnap.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	PDFSnap.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\Default.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	PDFSnap.exe

Executes dropped EXE 19 IoCs

pid	Process
2308	uninstall.exe
3968	RarExtInstaller.exe
1324	WinRAR.exe
2900	RarExtInstaller.exe
2076	WinRAR.exe
3680	WinRAR.exe
3808	WinRAR.exe
5536	WinRAR.exe
2532	WinRAR.exe
1364	WinRAR.exe
3932	RarExtInstaller.exe
5516	WinRAR.exe
3396	RarExtInstaller.exe
5664	WinRAR.exe
5492	WinRAR.exe
3308	WinRAR.exe
4944	WinRAR.exe
3168	WinRAR.exe
1040	WinRAR.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xxe	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe

Suspicious behavior: GetForegroundWindowSpam 12 IoCs

pid	Process
1324	WinRAR.exe
2076	WinRAR.exe
3680	WinRAR.exe
3808	WinRAR.exe
5536	WinRAR.exe
2532	WinRAR.exe
5516	WinRAR.exe
5492	WinRAR.exe
3308	WinRAR.exe
4944	WinRAR.exe
3168	WinRAR.exe
1040	WinRAR.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3684	PDFSnap.exe
3684	PDFSnap.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2308	3684	PDFSnap.exe	78
PID 2308 wrote to memory of 3968	2308	uninstall.exe	79
PID 1324 wrote to memory of 2900	1324	WinRAR.exe	83
PID 5516 wrote to memory of 3396	5516	WinRAR.exe	101

C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe
"C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
    3⤵
    - Executes dropped EXE
    PID:3968

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4524

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:2900

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:904

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2076

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5388

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2192

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5348

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5536

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:6096

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2532

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5568

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1364

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5956

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:3396

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1616

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2936

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5492

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5732

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3308

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3280

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4944

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3592

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3168

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5180

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\Program Files\WinRAR\Rar.exe
Size 816KB
SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
MD5 5b4a409a41c0032ba0070d35919655c3
SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
TLSH
T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 218KB
SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
MD5 4a59876cc56186ebb4e7ebc080b57264
SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
TLSH
T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtPackage.msix

Path C:\Program Files\WinRAR\RarExtPackage.msix
Size 23KB
SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
MD5 85b4bbcd102e0d0c655b72096ab48405
SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
TLSH
T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnRAR.exe

Path C:\Program Files\WinRAR\UnRAR.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A374813EDB1A6631387E414D3E73232

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
Size 166KB
SHA256 5e4069aaa9b737bf6ac36f9271e98dadf56085021a7e69633c722bb1e321596c
MD5 4d019c35fff8f4764726d19590d57451
SHA1 149a1652f4d5a1c6ec34198a0a4ae18026c4b105
SHA512 9934afa3b365ef3f80a50d2692e8563d6e56ea321940e57372dc3ef34b790dd90423c1aea6a5b0d1f6b3c463d2c1c06b63c3125ee3e654ec350504a0dc2b7ed4
SSDEEP 3072:W7wU1TqQEZogxwE8TFF1lUQ8aP1ygAwJcx+0VhCe:W7NTqB87AaP1LAacxtD
TLSH
T111F3FD288D187152E54AAD76D9CEAF9BCCB5B4C733D1954F96500F822422FCD8FD88B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A374813EDB1A6631387E414D3E73232

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
Size 306B
SHA256 cf7fc472e199a91bfb74aa0064305dd1767f306ce7c2c11e80a107f3e134afc0
MD5 d0d9f1352662e4b7d7aed8c55d05cf2f
SHA1 05d4cda1d505944bf59dc58f61a2f2ffa4ddfb19
SHA512 b047c15fc78b25ed1b47946083fcbc828134a099e24b4649439fd07134a2712a8a1e6a013af756120cb46ea958de67f217889eb7e1ac132ffc6389629a235651
TLSH
T1E2E0A5146FD05E37F1A6577F59F04751B556FD615513CB0507D0454D1C74F401C1051E
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 79f466e66e1cd7e9b97aa8bfee86ff648fc931d1482d3164620b1aac31611d47
MD5 6d25cbb7e28694103f4b3d877cc1da8c
SHA1 2abcc3b4bcd42dc5b61c1c085433f9e31e281e87
SHA512 e2f508012bc0483e95d20b3b35f4950852dacb807774389864668ad4f3a53447d33a4c7fe85f212ee73a409461093066a2d4815153e8011c24cb7543132e8d58
MD5 SHA1 SHA512

Submit Download

memory/904-139-0x000002F689080000-0x000002F68916A000-memory.dmp

Download

memory/904-112-0x000002F689080000-0x000002F68916A000-memory.dmp

Download

memory/1040-305-0x000001BFD5740000-0x000001BFD582A000-memory.dmp

Download

memory/1324-149-0x0000019D55840000-0x0000019D5592A000-memory.dmp

Download

memory/1324-106-0x0000019D55840000-0x0000019D5592A000-memory.dmp

Download

memory/1364-187-0x000001D9254A0000-0x000001D92558A000-memory.dmp

Download

memory/1616-262-0x000001D9973A0000-0x000001D99748A000-memory.dmp

Download

memory/1616-212-0x000001D9973A0000-0x000001D99748A000-memory.dmp

Download

memory/2076-113-0x000002033FB30000-0x000002033FC1A000-memory.dmp

Download

memory/2192-184-0x000002A68E110000-0x000002A68E1FA000-memory.dmp

Download

memory/2192-128-0x000002A68E110000-0x000002A68E1FA000-memory.dmp

Download

memory/2308-123-0x000001A6EAB00000-0x000001A6EABEA000-memory.dmp

Download

memory/2308-91-0x000001A6EAB00000-0x000001A6EABEA000-memory.dmp

Download

memory/2532-167-0x000001AEC92F0000-0x000001AEC93DA000-memory.dmp

Download

memory/2900-95-0x00000143BF080000-0x00000143BF16A000-memory.dmp

Download

memory/2936-229-0x00000204598F0000-0x00000204599DA000-memory.dmp

Download

memory/2936-283-0x00000204598F0000-0x00000204599DA000-memory.dmp

Download

memory/3168-286-0x0000020DD1170000-0x0000020DD125A000-memory.dmp

Download

memory/3280-324-0x0000024D19590000-0x0000024D1967A000-memory.dmp

Download

memory/3280-264-0x0000024D19590000-0x0000024D1967A000-memory.dmp

Download

memory/3308-247-0x00000239F4110000-0x00000239F41FA000-memory.dmp

Download

memory/3396-175-0x0000022829D40000-0x0000022829E2A000-memory.dmp

Download

memory/3396-176-0x0000022828010000-0x000002282801C000-memory.dmp

Download

memory/3396-177-0x0000022829FC0000-0x0000022829FD2000-memory.dmp

Download

memory/3592-285-0x000001B7E0160000-0x000001B7E024A000-memory.dmp

Download

memory/3592-346-0x000001B7E0160000-0x000001B7E024A000-memory.dmp

Download

memory/3680-118-0x0000014369DC0000-0x0000014369EAA000-memory.dmp

Download

memory/3684-66-0x0000017F42A40000-0x0000017F42B2A000-memory.dmp

Download

memory/3808-129-0x00000229E2EA0000-0x00000229E2F8A000-memory.dmp

Download

memory/3932-161-0x000001D4E58A0000-0x000001D4E598A000-memory.dmp

Download

memory/3932-163-0x000001D4E5BE0000-0x000001D4E5BF2000-memory.dmp

Download

memory/3932-162-0x000001D4E5540000-0x000001D4E554C000-memory.dmp

Download

memory/3968-99-0x000001CDA8E00000-0x000001CDA8EEA000-memory.dmp

Download

memory/3968-100-0x000001CDA8960000-0x000001CDA896C000-memory.dmp

Download

memory/3968-101-0x000001CDA8970000-0x000001CDA8982000-memory.dmp

Download

memory/3968-153-0x000001CDA8E00000-0x000001CDA8EEA000-memory.dmp

Download

memory/3968-154-0x000001CDA8960000-0x000001CDA896C000-memory.dmp

Download

memory/4524-105-0x0000029FF0DD0000-0x0000029FF0EBA000-memory.dmp

Download

memory/4524-126-0x0000029FF0DD0000-0x0000029FF0EBA000-memory.dmp

Download

memory/4944-265-0x000001C81CCC0000-0x000001C81CDAA000-memory.dmp

Download

memory/5180-365-0x0000027662730000-0x000002766281A000-memory.dmp

Download

memory/5180-304-0x0000027662730000-0x000002766281A000-memory.dmp

Download

memory/5348-195-0x000001F8FC590000-0x000001F8FC67A000-memory.dmp

Download

memory/5348-136-0x000001F8FC590000-0x000001F8FC67A000-memory.dmp

Download

memory/5388-117-0x000002D726810000-0x000002D7268FA000-memory.dmp

Download

memory/5388-164-0x000002D726810000-0x000002D7268FA000-memory.dmp

Download

memory/5492-230-0x00000255E5080000-0x00000255E516A000-memory.dmp

Download

memory/5516-198-0x0000014967370000-0x000001496745A000-memory.dmp

Download

memory/5516-245-0x0000014967370000-0x000001496745A000-memory.dmp

Download

memory/5536-137-0x0000021459050000-0x000002145913A000-memory.dmp

Download

memory/5568-186-0x000001AA4A7A0000-0x000001AA4A88A000-memory.dmp

Download

memory/5568-227-0x000001AA4A7A0000-0x000001AA4A88A000-memory.dmp

Download

memory/5664-213-0x0000024420FC0000-0x00000244210AA000-memory.dmp

Download

memory/5732-302-0x0000019DA4300000-0x0000019DA43EA000-memory.dmp

Download

memory/5732-246-0x0000019DA4300000-0x0000019DA43EA000-memory.dmp

Download

memory/5956-244-0x00000216AF960000-0x00000216AFA4A000-memory.dmp

Download

memory/5956-197-0x00000216AF960000-0x00000216AFA4A000-memory.dmp

Download

memory/6096-210-0x000001C4B2BF0000-0x000001C4B2CDA000-memory.dmp

Download

memory/6096-166-0x000001C4B2BF0000-0x000001C4B2CDA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads