Extracted

Extracted

• • Target
    WinRAR-723.exe
  • Size 319KB
  • SHA256 0501b47b11467d4ca1d2a3e1325fc1cf24614c89228ea884fbb7d0227323a244
  • MD5 b726f5637cb32735b3a4bd5b78658a73
  • SHA1 dad28d856b951d364ddc59b0556f368c9ff234ac
  • SHA512 39e251daabbe71741e841758f0ed554f1c64f51f9871d6c1e7f0280612c3e6e60ea978f2261080019412860270bb9616db5d8062434ab65fdbef697472e8ee66
  • SSDEEP 6144:WTA8oPwUhcX7elbKTusBknJgjRasYyvy+YNrhvbJZZQs6pQwrHxxmvY0Pa:WTAy3X3usBzlasYeYthvzZQs0Q4w6
  • TLSH
    T10C6412529B90C562D5F74A305DB1DB3B9B76FD124A908243234026AA7B337837F1FAB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionpersistenceprivilege_escalationspyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral1behavioral2