Overview

overview

5

Static

static

1

winrar-x64-723.exe

windows10-2004-x64

5

winrar-x64-723.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    36s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 14:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winrar-x64-723.exe
  • Size 3.7MB
  • Sample260801-rlgbeaxhmf
  • SHA256 f435b24d4c2c5342c4f7c0143ef358f0f425b7b8a0972dd34d9dcf94789e9c4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 60 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x64-723.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x64-723.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2788
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
    1⤵
      PID:1164
    • C:\Program Files\WinRAR\WinRAR.exe
      "C:\Program Files\WinRAR\WinRAR.exe"
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2760
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
      1⤵
        PID:3356
      • C:\Program Files\WinRAR\WinRAR.exe
        "C:\Program Files\WinRAR\WinRAR.exe"
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1784
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\WhatsNew.txt
        1⤵
          PID:660
        • C:\Program Files\WinRAR\WinRAR.exe
          "C:\Program Files\WinRAR\WinRAR.exe"
          1⤵
          • Executes dropped EXE
          PID:2312

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Rar.exe
              • Path C:\Program Files\WinRAR\Rar.exe
              • Size 826KB
              • SHA256 1639bfccc19b6fdd9becffb154edca06f07d1f337cc61933273f5b30dfb91882
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Rar.txt
              • Path C:\Program Files\WinRAR\Rar.txt
              • Size 110KB
              • SHA256 626b437acc8c23be798b1f3233f5636e64245941fb931f322cd9e65cb8c56a1f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RarExtInstaller.exe
              • Path C:\Program Files\WinRAR\RarExtInstaller.exe
              • Size 229KB
              • SHA256 091f077e4a8ffdca19430e9775b97d3b448e0c8ffdda52fb93b98268d38356f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UnRAR.exe
              • Path C:\Program Files\WinRAR\UnRAR.exe
              • Size 558KB
              • SHA256 806b42a2ae54eb8688841500aa70b3a3e4fcbe99059e612086cf9ccdc231b5ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\WinRAR\Uninstall.exe
              • Size 413KB
              • SHA256 c893bab6e0159ad6a3baea054f7341dd543ac0ca446671ce07aa93e97b540dc2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WhatsNew.txt
              • Path C:\Program Files\WinRAR\WhatsNew.txt
              • Size 64KB
              • SHA256 aadee800c40e3437867f644057dee828e67fcc6da65004b0a981c000a4e0a58d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinRAR.chm
              • Path C:\Program Files\WinRAR\WinRAR.chm
              • Size 320KB
              • SHA256 cb5edb04ac5e879243dae4f1f6d8253b8653dc6c57473bd0b3f3d23fd1861f61
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinRAR.exe
              • Path C:\Program Files\WinRAR\WinRAR.exe
              • Size 3.2MB
              • SHA256 ab727aec2418a942a1adf5295efb9c676eeba39d16f7c2443e3f873fe2dfca14
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              version.dat
              • Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
              • Size 12B
              • SHA256 f32ccf67b45e129989d05484364ace047c03b0c2181e8398682f05ea5c7ba034
              • MD5 SHA1 SHA512
              Submit Download