Analysis
- max time kernel
147s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
KitchenCanvas.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
KitchenCanvas.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target KitchenCanvas.exe
- Size 3.6MB
- Sample260528-pjcjbsgt21
- SHA256 cfca124c2141b4171cebad48cc286751910b408aec69767db2bc3af38f277a06
- MD5 273fd2329712084f98f4ba825b8f7cec
- SHA1 ee8e5c7f1be09201386f94e04e2dcb76cf0d07b4
- SHA512 0cec0eb35863a70f5768b30766faddd3a1df6b8ac6f5bb9f10ffc42d073c3d420b249c3fabf7bf1d48f6343369421ea3bd71dd03d647e064dbca907fa9694c8f
- SSDEEP 98304:2+MBAAANiDGq/Ivo83YWOPQPvwnj749GfTP3eQzf+4Rv:c+iDGQI1yIELPeb8v
- TLSH T1E106231ED79459F5E277E134C8A2050BD9B23C8D4B30DACF23A659962F236A44F3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\WinRAR\License.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\RarFiles.lst KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Rar.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\7zxa.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Default.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png KitchenCanvas.exe File created C:\Program Files\WinRAR\WhatsNew.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExt.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\Default.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\WinCon.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\WinCon32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\Rar.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\UnRAR.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png KitchenCanvas.exe File created C:\Program Files\WinRAR\WinRAR.chm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Descript.ion KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\Default32.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinCon32.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Zip32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst KitchenCanvas.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240673187 KitchenCanvas.exe File created C:\Program Files\WinRAR\ReadMe.txt KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Rar.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExt32.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\Resources.pri KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png KitchenCanvas.exe File created C:\Program Files\WinRAR\Rar.txt KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Resources.pri KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtPackage.msix KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm KitchenCanvas.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Uninstall.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\Order.htm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR KitchenCanvas.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png KitchenCanvas.exe File created C:\Program Files\WinRAR\WinRAR.exe KitchenCanvas.exe File created C:\Program Files\WinRAR\Descript.ion KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll KitchenCanvas.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\Order.htm KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\Zip.SFX KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\License.txt KitchenCanvas.exe File created C:\Program Files\WinRAR\Uninstall.lst KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll KitchenCanvas.exe File opened for modification C:\Program Files\WinRAR\Default32.SFX KitchenCanvas.exe File created C:\Program Files\WinRAR\Zip32.SFX KitchenCanvas.exe - Executes dropped EXE 18 IoCs
pid Process 4468 uninstall.exe 2648 RarExtInstaller.exe 3804 WinRAR.exe 1256 RarExtInstaller.exe 600 WinRAR.exe 576 WinRAR.exe 2828 WinRAR.exe 4552 WinRAR.exe 4624 WinRAR.exe 1688 RarExtInstaller.exe 4780 WinRAR.exe 4524 WinRAR.exe 2072 WinRAR.exe 1160 WinRAR.exe 792 WinRAR.exe 4836 WinRAR.exe 4924 WinRAR.exe 1604 WinRAR.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.z uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe - Suspicious behavior: GetForegroundWindowSpam 10 IoCs
pid Process 3804 WinRAR.exe 576 WinRAR.exe 2828 WinRAR.exe 4624 WinRAR.exe 4780 WinRAR.exe 4524 WinRAR.exe 1160 WinRAR.exe 4836 WinRAR.exe 4924 WinRAR.exe 1604 WinRAR.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4516 KitchenCanvas.exe 4516 KitchenCanvas.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4468 4516 KitchenCanvas.exe 80 PID 4468 wrote to memory of 2648 4468 uninstall.exe 81 PID 3804 wrote to memory of 1256 3804 WinRAR.exe 85 PID 4624 wrote to memory of 1688 4624 WinRAR.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe"C:\Users\Admin\AppData\Local\Temp\KitchenCanvas.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
PID:2648
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5060
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:1256
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3964
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:600
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1056
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:576
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:5044
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2828
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1636
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:4552
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4484
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
PID:1688
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1156
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4780
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4540
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4524
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:2836
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:2072
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1164
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1160
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:4848
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
PID:792
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1116
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4836
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:3992
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4924
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt1⤵PID:1600
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.exe
- Size 816KB
- SHA256 2ce9d9f8cd10e8ceb3a943e1464938ecab682313f8e4525df17068b3eae5b05b
- MD5 5b4a409a41c0032ba0070d35919655c3
- SHA1 44a9de2d53bf00a7e9087285815fd0d0184f3c63
- SHA512 b16731a4d0f5a81803b76b9e34d40ce2f3002d2a39693e98ad2e06cffe7e28bdd5b0c91ebfd1e1f97f69ca29db7e9ad84b7b091fd79bea72067fa79e5ab18fea
- SSDEEP 12288:B8XG6W55dhVSj06rSkYT2gf28DRTh5lqiSYFI7cfRTPFQN+xw6b4:B8264bbIGk62gXXWAfRKp6b4
- TLSH T1F4058E1A9FE801FCE0F7D674CE915917EBB3780A57B1968F0390499A5F272608E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Rar.txt
- Size 110KB
- SHA256 c6eb9a85f529808571cd04e3d752b5269d3b7be0b3f2f1cbac011942b326103e
- MD5 9a08ebded98c1260436a21869e80b1d9
- SHA1 3951c44ca35fce4c8218d44e4aae1e568ea3205a
- SHA512 7687c5643cb71d8a82d78da72e7d0f42d0ba8dfd0fba73ea89a323fdb50fc694d0ac0da7bfb47880ed63a336a639f52e4935ddc4aaeeb0df068c6face10d122a
- SSDEEP 768:2odhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:2odhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
- TLSH T124B3C8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A393F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 218KB
- SHA256 eefc81979f082c8dbab05ff3a68930501f2226a7e2688903b2806e2eb6837a5a
- MD5 4a59876cc56186ebb4e7ebc080b57264
- SHA1 c510f9ad275cdb1e63ba1572a5ff517ea1409f28
- SHA512 519a7ffc643daf9c25a940476a3188276b127ab0dff3145929c0b95037e574e02d66feabc292514aa32b603044bc1992ce531151d012bb0ee961868281a650f8
- SSDEEP 3072:PRWaJPSzTpyd+apAd8EblNw3i9nUaszEBJFsNLbrz2x1mtdEBj:DJKzSzpAddvaiPBJSLPY1Idej
- TLSH T19D247B49F2B550E6EABBD435C9624601FF3278454760EBCB27500BB99E33BE19E3A701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 74d160f732ae20d0e10088aa7b609d903801fd27ff16270a1c1ec0e7724fb33a
- MD5 85b4bbcd102e0d0c655b72096ab48405
- SHA1 59fa358897d58f894f0dbc3b4c87b5b72a41ece5
- SHA512 4ea213391cdecdbe21e1a7f229dce2a7cc84ddb27cfca6221ce76ecb7efbe14a125c0a72cb0e33f8a03bc506f6374cd94ddb846955773332a41add7e384ddf7c
- SSDEEP 384:deR015ziBz4oqvhFv+qkDfm0fxPZA7SxEDHV6sZd3Ns9TLrSw7EGkDw+zcLVHok5:SYzMzHshFvbkDeoZ76MsZd3+zJkk+zcT
- TLSH T1ACB2C0F2F74A2963DB1F45718BA38A759908ED9015034E45B7D8253082E8F3A0357BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 402KB
- SHA256 926df1506082e88f388f394f4c9d190a23b21e1519acf03d0e474528bb920c8b
- MD5 a49476fbc8efa147bec8df78b46e1d52
- SHA1 ba08ed7bae509ae98205870493f5406edf2592c2
- SHA512 749ef159c1ec81bc819fdbbf2f2444a0d1610d1690f57eff0f2d459b2228542e74496da0fe452f7743b36c8808f7527cfc5f6beb0358b185e86add8b5a398c2d
- SSDEEP 6144:DlnAoo4pIa63bknS2ecOTJDPv0qVSfqeb0eC2TIII+Sn5HBK7jcRE:Rng3QnS2EJz8qUHDC2TIIvS5ejca
- TLSH T133948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 61KB
- SHA256 5ec6594b8e544fe47985ddf252f895af17c5db5e4655b6bdb7c45e890844b513
- MD5 18c37699b070b94831c300cf15c4fca6
- SHA1 48082b6c6513e8e3df463232f10d67d43a27ceb0
- SHA512 a13d19d21b49fca789322de10db0eedf738a8e8b43cac6a8624d137811d1203810d8f8e645a0dcbf94edf9e1258d78f3579ecf23b7c8a6de471944cf7b721cae
- SSDEEP 768:UKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:FKDakJ/xl41kVxwXicDYb3fXxuqoR
- TLSH T11B53A5237D9A137129B242856E166295F31861AF370B42C4787C838C3F369A7D2F76F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 321KB
- SHA256 3f63a1c62f171902906e0b0bd720259aafe4786ddc5078953da73ac77f9ffea4
- MD5 b27aa2dfef0eb2c4466e2f8a624ee5cc
- SHA1 1d4ccdc08be93625a51fea34be431a381d4dc8b5
- SHA512 cf601058f1527f7e2610ce6ab46b5a4edb1f4e9a2fc3affe92856188a80c5de7b38897f34b8dd80bfbd075376787624113043ccccc2a1cef990c3072169cb5d7
- SSDEEP 6144:pWW9QxMqukTxMXyI/CKoFBWIIvEIoryJ1Mi44G9XMIyikvRSZPz:F9sMqukzI/pokGr81gTcvRS5z
- TLSH T1FA64120A2D0C05B2E5C8BDB9CAEC53CC1F284A854952BE1F6D6F6B3945C0FECB0A9751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 3.3MB
- SHA256 b3a8469d2b132391d206d0799b34c563c0bdf6e7166a378e249f45848f5f1cb8
- MD5 1332606c405863d514138396940d03b8
- SHA1 e9a22ce1b80a1e424a024ea1acda0acf54b8312b
- SHA512 20ce0964798586cc714c0d971e73330d0d7e806570ff720397701be5b4089d5b3010ef39e6534b15f7574f7d72860205c855678606e7ea3c66ee35169bb22ba7
- SSDEEP 49152:GcwbFR+/2n/JAERZIFKBb093AXgK2x3U3Cc6fPZ8czUeT+uXEkjNEEBHLu:GDxm/AFa+uUkjDBHLu
- TLSH T18FF5AE1AA3E406BCE0F7C679CED5C553E776780D07B0A69F069098A64F732609E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 727B
- SHA256 52bf37c7397f2a763f4362f5840648407130c58d740fac9619cc939ae9ea8858
- MD5 32c1cb508685f49695c9edca7e49b6df
- SHA1 21b1a572827c5347fe2c8893de649134cb36b441
- SHA512 d4d9a722e68537d78058865f285962639fe9cc86a8f113cdc46ca9160f35a7ee8a8540123bcf8768f35bf563762ce745071100612fde2e89e6962c3faddf375a
- TLSH T1B90160066E7CE0590A0444C68A5BCABAB26842D02BDB0213A234D7CAE018E280E22838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 64bb1d493d04ea37c1d4cc74e1f39035ddb9ed5be0dac893b5af2b06d34e9595
- MD5 9e2eef1686bbe7a950097cb08d4adabf
- SHA1 07b3f238c21d6ed7e9a593c037381e45791cb3f5
- SHA512 21ce446e2055efa316600f9b9f401e66c6f00721f4507d8a7618b3be3c4f076228e8cdce97ec540074ab0ba4aac79402dbea53896c6e99b807822550ce46cebb
- TLSH T15C01100B0C79294179025D97C7D882B26167E3C0168823F8B7C078CE567AAD97303068
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D96A4C3B75E862E237A6B89F58F74354
- Size 404B
- SHA256 98c959c88537bc6f82cece570f7f984c7f6830db1a461e46a50a1eea1949530a
- MD5 8caf8abec16330b0d662aa52de0bbf86
- SHA1 f8d92b80e28bd91fd61205e9f0c5bba7e1750777
- SHA512 e0cfe36c664cd91e42d73230df6e611a94e1959d619b66585a8953abd712b44b29d23475618f282c6a09008a01b3fbd52c0a7b380097f8fa19935e7938dc2e88
- TLSH T1E6E0203422FE495DF0F5D87403F699114A56F2660551C6ED104057567911F405D91634
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 f4dfeb7411f8cba80aa7e8d598893710c4b82ca43eee586678debb3e0d146903
- MD5 fdeb6a0c3e1bb21d500cb3534730e648
- SHA1 bef39634e427900cbdbcbc0eabb4526b5ebb4813
- SHA512 a255322896d9083e7243f30eaf214994e27a181c197dab50b55c96ca1cc9a38b56b4655d950a7d3e3fc5fb886495573fd446082d49f357cb724cf667230985e3
- TLSH T1DEE0DF2827FFA52EF0A099754AE9E1765DA9F3012D6497B911D04308BB4AF00AD14AB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
- Size 12B
- SHA256 7c1105a810cd5252c35c8360269e4c1047c5ff34f9aa836340092236cc16260d
- MD5 3933afea902e7fa16b89dade3af15a57
- SHA1 9925e2acff0cf2c7635fcff7913b097967d8e747
- SHA512 f7905716efc14ede7233c79c7b1b86ab209701af6443cbe24ca30d1ad1f6af7f6679d2624f831733d1c13b6ddc2d81a468d1feb45746255d78c6ec4dff47fcdb
- MD5 SHA1 SHA512