Overview

overview

7

Static

static

3

.exe

windows10-2004-x64

5

.exe

windows11-ltsc_2024-x64

6

Setup.exe

windows10-2004-x64

7

Setup.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    37s
  • max time network
    73s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 12:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    .exe
  • Size 3.4MB
  • Sample260627-n8cd7aa18l
  • SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarediscoverypersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 46 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\.exe
    "C:\Users\Admin\AppData\Local\Temp\.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5500
      • C:\Program Files\WinRAR\RarExtInstaller.exe
        "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
        3⤵
        • Executes dropped EXE
        PID:692
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5668
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3508
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2916
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2644

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Rar.txt
          • Path C:\Program Files\WinRAR\Rar.txt
          • Size 109KB
          • SHA256 59334a8ffff612755a64a912389bc23fbc35933cf209f845bde34f055011b8a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RarExtInstaller.exe
          • Path C:\Program Files\WinRAR\RarExtInstaller.exe
          • Size 179KB
          • SHA256 48b44bd3342a68ecbbd40a485930a22e02fdf157b2939ee346c2b123f6d5e99c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RarExtPackage.msix
          • Path C:\Program Files\WinRAR\RarExtPackage.msix
          • Size 23KB
          • SHA256 10a9e66b22922211668c9d9be62e309e824ca72114be9e0d090c15ba297ca787
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\WinRAR\Uninstall.exe
          • Size 429KB
          • SHA256 fd934c3b663679041b82c12d60b14c51060d8d04742612ed5f9cfa82cccf1d37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WhatsNew.txt
          • Path C:\Program Files\WinRAR\WhatsNew.txt
          • Size 105KB
          • SHA256 bf30a7d667b61a90bc00908317d96599386c841759540bdb74ca249e28ec8624
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinRAR.chm
          • Path C:\Program Files\WinRAR\WinRAR.chm
          • Size 317KB
          • SHA256 9d96fddee6df94a3b6bfa731e962d31fedd4d8123aaf29c231b06f0cc10a2b2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinRAR.exe
          • Path C:\Program Files\WinRAR\WinRAR.exe
          • Size 2.4MB
          • SHA256 0d068a6aa2df88613e1c5c7ba412a5a5bc3cadc3f3ab4b76d10035ba8eec27bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Console RAR manual.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
          • Size 1KB
          • SHA256 ff0ae610e5ef835cdac3a4f2df988b4a6fb21355c89a4430ad452c2128258ac3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          What is new in the latest version.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
          • Size 1KB
          • SHA256 8aae263c8b2944987c3309c7293e92d8c80dd61d3a47cbe697857b5e2538cd8c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WinRAR help.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
          • Size 1KB
          • SHA256 cb00009105c19eea73e5e950bb62489273e8c6249500d38e4debe965a8ba52b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WinRAR.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
          • Size 1KB
          • SHA256 a7596c9d274841f65e94cea3c81eddf6ecc9393b49a9eab5897255c35abe0352
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2916-116-0x0000024F001E0000-0x0000024F002E0000-memory.dmp
          Download

          memory/2916-129-0x0000024F14300000-0x0000024F14400000-memory.dmp
          Download

          memory/2916-128-0x0000024F01EA0000-0x0000024F01EC0000-memory.dmp
          Download

          memory/2916-162-0x0000024F14B80000-0x0000024F14BA0000-memory.dmp
          Download

          memory/2916-139-0x0000024F04100000-0x0000024F04120000-memory.dmp
          Download

          memory/4684-63-0x00000138829C0000-0x0000013882A3C000-memory.dmp
          Download

          memory/5500-292-0x0000021C5A610000-0x0000021C5A68C000-memory.dmp
          Download

          memory/5500-93-0x0000021C5A610000-0x0000021C5A68C000-memory.dmp
          Download

          memory/5668-288-0x0000000005E50000-0x0000000005ECC000-memory.dmp
          Download