cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDFSnap.exe
Size 3.6MB
Sample260504-ajftesav5x
SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
MD5 273fd2329712084f98f4ba825b8f7cec
SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
TLSH
T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\Rar.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Descript.ion	PDFSnap.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\7zxa.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\Order.htm	PDFSnap.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	PDFSnap.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\License.txt	PDFSnap.exe
File created	C:\Program Files\WinRAR\Resources.pri	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	PDFSnap.exe
File created	C:\Program Files\WinRAR\Default32.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	PDFSnap.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExt.dll	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\Zip.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	PDFSnap.exe
File created	C:\Program Files\WinRAR\Rar.exe	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	PDFSnap.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\Rar.txt	PDFSnap.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	PDFSnap.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	PDFSnap.exe
File created	C:\Program Files\WinRAR\Default.SFX	PDFSnap.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	PDFSnap.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240656843	PDFSnap.exe

Executes dropped EXE 19 IoCs

pid	Process
5920	uninstall.exe
3760	RarExtInstaller.exe
1508	WinRAR.exe
2936	RarExtInstaller.exe
680	WinRAR.exe
412	RarExtInstaller.exe
2892	WinRAR.exe
2056	RarExtInstaller.exe
5360	WinRAR.exe
4596	WinRAR.exe
656	WinRAR.exe
4460	WinRAR.exe
5116	WinRAR.exe
4140	WinRAR.exe
2612	WinRAR.exe
5148	WinRAR.exe
2596	WinRAR.exe
4992	WinRAR.exe
2652	WinRAR.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe

Suspicious behavior: GetForegroundWindowSpam 13 IoCs

pid	Process
1508	WinRAR.exe
680	WinRAR.exe
2892	WinRAR.exe
5360	WinRAR.exe
4596	WinRAR.exe
656	WinRAR.exe
5116	WinRAR.exe
4140	WinRAR.exe
2612	WinRAR.exe
5148	WinRAR.exe
2596	WinRAR.exe
4992	WinRAR.exe
2652	WinRAR.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4092	PDFSnap.exe
4092	PDFSnap.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 5920	4092	PDFSnap.exe	80
PID 5920 wrote to memory of 3760	5920	uninstall.exe	81
PID 1508 wrote to memory of 2936	1508	WinRAR.exe	85
PID 2892 wrote to memory of 2056	2892	WinRAR.exe	93

C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe
"C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\WinRAR\uninstall.exe
  "C:\Program Files\WinRAR\uninstall.exe" /setup
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Program Files\WinRAR\RarExtInstaller.exe
    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
    3⤵
    - Executes dropped EXE
    PID:3760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2284

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:2936

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5488

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:680

C:\Program Files\WinRAR\RarExtInstaller.exe
"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
1⤵
- Executes dropped EXE
PID:412

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:3672

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:2056

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5616

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:5360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:848

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4596

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4592

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:656

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:1580

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:484

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5116

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2592

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5036

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2612

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:2508

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5148

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:4928

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2596

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5044

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4992

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
1⤵
PID:5180

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\Program Files\WinRAR\Rar.exe
Size 816KB
SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
MD5 5b4a409a41c0032ba0070d35919655c3
SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
TLSH
T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
MD5 9a08ebded98c1260436a21869e80b1d9
SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtInstaller.exe

Path C:\Program Files\WinRAR\RarExtInstaller.exe
Size 218KB
SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
MD5 4a59876cc56186ebb4e7ebc080b57264
SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
TLSH
T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExtPackage.msix

Path C:\Program Files\WinRAR\RarExtPackage.msix
Size 23KB
SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
MD5 85b4bbcd102e0d0c655b72096ab48405
SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
TLSH
T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnRAR.exe

Path C:\Program Files\WinRAR\UnRAR.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
MD5 a49476fbc8efa147bec8df78b46e1d52
SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
TLSH
T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 61KB
SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
MD5 18c37699b070b94831c300cf15c4fca6
SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 321KB
SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
TLSH
T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.3MB
SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
MD5 1332606c405863d514138396940d03b8
SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
TLSH
T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 727B
SHA256 3734619d4786a3e93ad24fae1f3c12fa3295c3e58d6130193277f866be595136
MD5 9921576d0d13e439286d8a5de2d6d990
SHA1 54e1373de5fd61c8d7c332815e525d06353547d7
SHA512 3395c36c79441b7094495c244bcb958f2b90cc55022da4bfb8c104f52d7f2fcaeb63f9741c1b81d3756ac9515e17a93573448f0741c5fc8ddd83e65a14d72f5c
TLSH
T1F701B5413C770E499F0215528F4CD73038D38748785C411A2F63338989883991FEA91C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ae479d4ecdc5eab901290785ee6e30fbcefb56fb3a8d8aa22e0e7c8e321d349e
MD5 d425d8e180ea9023a5e5f6cbb63b54c3
SHA1 f87badda86a7ed275e1413b2da74c5848f5e2781
SHA512 538a5753d27ff19d0aed42ad59e9f9da083e657db31ea6a050025a417d2b892ab744a8251628a8840fde9c56053e2a4fd6772845c43c43d4413d805f83fc8916
TLSH
T17301650255ACD75075008D22DBDCBEF4F16BE2E8398C0A90295C78EE0ABD315C1D6C50
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
Size 404B
SHA256 f4acc6417aa68c2ec1af1cb5932bcbc0cfa16dc13aafbfe9c26e19a41b9ada97
MD5 18a26b89c02e935489a72ec4f1b77978
SHA1 c97ba6693c367dd56516b83346cfe1b7b002112c
SHA512 c5c04972b17602c963615bbd7353ad6b42af36f7eafc1f6195429cf1ca8eaa083c4c3b4e20aa8ce8b29739016764b69225265d03e26e5270a010b82ef62971f2
TLSH
T142E0C03421FA052CF5F0D87802FAED1187DAF1460111D35D1140A707AA11B805D91524
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ec1d77f6a9dbc5eb3aef5b61e558662436ed47045519ab04a6548eff906b699d
MD5 0e8d259fa8db13f006203a167c374af2
SHA1 8cc37ba7ed16f9323cf599e77f7b01169271049a
SHA512 f4fd7dbad81b012b0e08ca2b2e6a141af73188d41df2a37ce19c1e8aca747cc0d507eb107fe46696db6ea1e8bb99125d456accbe271a128e28a5131bd40e23de
TLSH
T1F0E0682C1AAB651EF190983842F5E57A0D88F3012490927921819308BB03F045C109B0
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 8ae4a157a1864993b59591bf0f9fab1b511af9b4510f4dccc04dcd60492869e3
MD5 55007a0172bba82676e8bbe0decd7a3c
SHA1 9605faaa3dc5c758fc5399e0f86b7a231546f879
SHA512 933a44695f5f4431a35b132fabcaf362a1c1b1c2c17e9a29d216dcc478d3a098ebae17cceefeb44b10a547658020d4f6f924fd19b5fc56abd7fb52bac1461887
MD5 SHA1 SHA512

Submit Download

memory/412-118-0x0000020669020000-0x0000020669032000-memory.dmp

Download

memory/484-180-0x0000021151970000-0x0000021151B0A000-memory.dmp

Download

memory/656-159-0x00000265EC120000-0x00000265EC2BA000-memory.dmp

Download

memory/680-129-0x00000218BF950000-0x00000218BFAEA000-memory.dmp

Download

memory/848-149-0x00000185B0DB0000-0x00000185B0F4A000-memory.dmp

Download

memory/1508-120-0x00000241BB010000-0x00000241BB1AA000-memory.dmp

Download

memory/1580-171-0x000002338E5E0000-0x000002338E77A000-memory.dmp

Download

memory/2056-126-0x000002054A080000-0x000002054A092000-memory.dmp

Download

memory/2284-119-0x0000020D73E40000-0x0000020D73FDA000-memory.dmp

Download

memory/2508-230-0x0000022D4DD90000-0x0000022D4DF2A000-memory.dmp

Download

memory/2592-197-0x000001E06DFE0000-0x000001E06E17A000-memory.dmp

Download

memory/2596-247-0x000001444E570000-0x000001444E70A000-memory.dmp

Download

memory/2612-211-0x0000029AD6650000-0x0000029AD67EA000-memory.dmp

Download

memory/2652-286-0x0000018E9A2C0000-0x0000018E9A45A000-memory.dmp

Download

memory/2892-134-0x000002970DA10000-0x000002970DBAA000-memory.dmp

Download

memory/3672-133-0x0000013340440000-0x00000133405DA000-memory.dmp

Download

memory/3760-94-0x0000021DB95E0000-0x0000021DB95F2000-memory.dmp

Download

memory/4092-66-0x0000024CA74C0000-0x0000024CA765A000-memory.dmp

Download

memory/4140-198-0x0000020CDC5F0000-0x0000020CDC78A000-memory.dmp

Download

memory/4460-172-0x000001C12B870000-0x000001C12BA0A000-memory.dmp

Download

memory/4592-158-0x00000259F5FE0000-0x00000259F617A000-memory.dmp

Download

memory/4596-150-0x000002037C230000-0x000002037C3CA000-memory.dmp

Download

memory/4928-246-0x00000210C7690000-0x00000210C782A000-memory.dmp

Download

memory/4992-271-0x00000209CEF30000-0x00000209CF0CA000-memory.dmp

Download

memory/5036-210-0x000001439DFA0000-0x000001439E13A000-memory.dmp

Download

memory/5044-270-0x00000265B26F0000-0x00000265B288A000-memory.dmp

Download

memory/5116-181-0x0000028A9DF80000-0x0000028A9E11A000-memory.dmp

Download

memory/5148-231-0x0000020FE4B50000-0x0000020FE4CEA000-memory.dmp

Download

memory/5180-285-0x000002C803800000-0x000002C80399A000-memory.dmp

Download

memory/5360-142-0x0000021C89AB0000-0x0000021C89C4A000-memory.dmp

Download

memory/5488-128-0x0000020A505B0000-0x0000020A5074A000-memory.dmp

Download

memory/5616-141-0x0000025EB6040000-0x0000025EB61DA000-memory.dmp

Download

memory/5920-87-0x000002692C480000-0x000002692C61A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads