Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
PDFSnap.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PDFSnap.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target PDFSnap.exe
- Size 3.6MB
- Sample260525-pe9chaft2k
- SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
- MD5 273fd2329712084f98f4ba825b8f7cec
- SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
- SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
- SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
- TLSH T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\Zip32.SFX PDFSnap.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR PDFSnap.exe File opened for modification C:\Program Files\WinRAR\License.txt PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll PDFSnap.exe File created C:\Program Files\WinRAR\Resources.pri PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Resources.pri PDFSnap.exe File created C:\Program Files\WinRAR\Default.SFX PDFSnap.exe File created C:\Program Files\WinRAR\WinCon32.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt PDFSnap.exe File created C:\Program Files\WinRAR\7zxa.dll PDFSnap.exe File opened for modification C:\Program Files\WinRAR\WinCon32.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX PDFSnap.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240677812 PDFSnap.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe PDFSnap.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt PDFSnap.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe PDFSnap.exe File created C:\Program Files\WinRAR\RarExt32.dll PDFSnap.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png PDFSnap.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe PDFSnap.exe File created C:\Program Files\WinRAR\Descript.ion PDFSnap.exe File created C:\Program Files\WinRAR\ReadMe.txt PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst PDFSnap.exe File created C:\Program Files\WinRAR\RarExt.dll PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll PDFSnap.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png PDFSnap.exe File created C:\Program Files\WinRAR\WinRAR.chm PDFSnap.exe File created C:\Program Files\WinRAR\Uninstall.exe PDFSnap.exe File created C:\Program Files\WinRAR\Zip.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Order.htm PDFSnap.exe File created C:\Program Files\WinRAR\RarFiles.lst PDFSnap.exe File created C:\Program Files\WinRAR\Uninstall.lst PDFSnap.exe File created C:\Program Files\WinRAR\UnRAR.exe PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Rar.exe PDFSnap.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\Rar.exe PDFSnap.exe File created C:\Program Files\WinRAR\Zip32.SFX PDFSnap.exe File created C:\Program Files\WinRAR\Order.htm PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Rar.txt PDFSnap.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png PDFSnap.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe PDFSnap.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Default.SFX PDFSnap.exe File created C:\Program Files\WinRAR\WinCon.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Descript.ion PDFSnap.exe File created C:\Program Files\WinRAR\WinRAR.exe PDFSnap.exe File created C:\Program Files\WinRAR\RarExtPackage.msix PDFSnap.exe File created C:\Program Files\WinRAR\Default32.SFX PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe PDFSnap.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX PDFSnap.exe File created C:\Program Files\WinRAR\WhatsNew.txt PDFSnap.exe File created C:\Program Files\WinRAR\Rar.txt PDFSnap.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png PDFSnap.exe File created C:\Program Files\WinRAR\License.txt PDFSnap.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix PDFSnap.exe - Executes dropped EXE 19 IoCs
pid Process 4800 uninstall.exe 3768 RarExtInstaller.exe 3640 WinRAR.exe 1376 RarExtInstaller.exe 4280 WinRAR.exe 2068 RarExtInstaller.exe 1816 WinRAR.exe 1300 RarExtInstaller.exe 4360 WinRAR.exe 8 WinRAR.exe 3656 WinRAR.exe 4816 WinRAR.exe 1772 WinRAR.exe 3720 WinRAR.exe 2684 WinRAR.exe 3468 WinRAR.exe 3768 WinRAR.exe 1844 WinRAR.exe 1800 WinRAR.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.taz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe - Suspicious behavior: GetForegroundWindowSpam 12 IoCs
pid Process 3640 WinRAR.exe 4280 WinRAR.exe 1816 WinRAR.exe 4360 WinRAR.exe 3656 WinRAR.exe 4816 WinRAR.exe 1772 WinRAR.exe 2684 WinRAR.exe 3468 WinRAR.exe 3768 WinRAR.exe 1844 WinRAR.exe 1800 WinRAR.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1820 PDFSnap.exe 1820 PDFSnap.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1820 wrote to memory of 4800 1820 PDFSnap.exe 81 PID 4800 wrote to memory of 3768 4800 uninstall.exe 82 PID 3640 wrote to memory of 1376 3640 WinRAR.exe 86 PID 1816 wrote to memory of 1300 1816 WinRAR.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe"C:\Users\Admin\AppData\Local\Temp\PDFSnap.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
PID:3768
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3244
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:2336
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4280
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
PID:2068
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4092
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1392
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4360
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1996
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:8
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3212
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3656
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3064
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4816
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1616
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1772
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4144
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:3720
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3752
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2684
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:236
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3468
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:2188
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3768
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1128
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1844
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4588
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.exe
- Size 816KB
- SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
- MD5 5b4a409a41c0032ba0070d35919655c3
- SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
- SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
- SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
- TLSH T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Rar.txt
- Size 110KB
- SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
- MD5 9a08ebded98c1260436a21869e80b1d9
- SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
- SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
- SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
- TLSH T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 218KB
- SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
- MD5 4a59876cc56186ebb4e7ebc080b57264
- SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
- SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
- SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
- TLSH T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
- MD5 85b4bbcd102e0d0c655b72096ab48405
- SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
- SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
- SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
- TLSH T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 402KB
- SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
- MD5 a49476fbc8efa147bec8df78b46e1d52
- SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
- SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
- SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
- TLSH T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 61KB
- SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
- MD5 18c37699b070b94831c300cf15c4fca6
- SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
- SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
- SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
- TLSH T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 321KB
- SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
- MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
- SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
- SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
- SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
- TLSH T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.3MB
- SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
- MD5 1332606c405863d514138396940d03b8
- SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
- SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
- SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
- TLSH T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 727B
- SHA256 568de06dc704f03cb6a0e8d42035600bdab0b02289a4689bf5daec82e0408fd3
- MD5 ce5089f1b5a59ac11681759e02b330cc
- SHA1 7a3f8fdf8072d38ebc7642122dd9f7f1d1332016
- SHA512 86e07688a5578032d4942f5c902b7b1061ee5d298e0f542aae517c2d8eae9731147d917acfcd290c5d3ebd4171e97b3d6a34c0552192208c0240b513461f6226
- TLSH T1BD0194041F3C77470C200A84DB89EAB931E143303EDD1B0F623B2B88AD8A3416CEA604
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 990a7c5e925c10c72a79f8bf799681dc1d4973da7fd16063a0da88f3b935e957
- MD5 37d96f155b40b717cb8d722053768850
- SHA1 1293a64273d8dfeaa6f5cc775ebc2a909bb8cd95
- SHA512 3895ec4be8a251ddeb39c8976093013fe39c8562c6a8c41fbee1a29a19d96e0aaebac8e863217eb6f89d609e55c1e46db3a0bc28d124cd74e3ec4f8bb93a5754
- TLSH T19801655650D75D1930514EA1AFFC057035BBC2E461494245256A709B40FE332284288D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 404B
- SHA256 fa8914bfe934762556e134af3a717862990df29547478b2ce90a32980f68203b
- MD5 86b8d9217b90ffb0b40b9e08f51b48a5
- SHA1 98087bb48fc4c4d9065447b144b08d339725f55e
- SHA512 801c437893684c692fe0cd41cd4087798c7f7f88ae3ff83049de67e038865b843ab22b0ec650375c33a7213807f872f75f8859faf9529bc9731803771f9a0a54
- TLSH T15BE0C03422FA459CF0F4D43452FAD8117796F1530441835C10405B47AD12F804DF2A34
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 6273f8e24776799313038c4cf97c70a229920bd8704a4d5bfceb3dbdc6d4ada8
- MD5 d9bafc4375b0b5dec73b97347c514d5d
- SHA1 bf6c25ea18dfcbf0da8491945c44ee7615b453ac
- SHA512 1c9781869e32cd9a6f72ba16eb1119394542313bc2f44aa5005123d0b9107d04cf1c673e5ac9c2cdce4f63de88424e4dbead2c40df11d2136b6686544a9fb3b6
- TLSH T172E068381AFB655FF090D83045F9E1764E88F221285483B800D04B08BB03E015C31AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
- Size 12B
- SHA256 5f130aa4b71a13ec5e76382720dc1b4935aa1cb7fc4990730c37d52bcafd4de3
- MD5 16bdd76e5d46befed6bfc69fdeb053ef
- SHA1 9103b78534efdc873b26286bec06a6eb2172cae5
- SHA512 e44deb763a463b6ba3bcc8b1bdecf2a4561e976a18a5d4141c2f97da02dafa88628ea8efb0c1873664851416fbfca2b207852ee1f657da9b3a463a19c50d8d2e
- MD5 SHA1 SHA512