Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 07:14
Behavioral task
behavioral1
Sample
.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Baby Blimp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target .exe
- Size 3.4MB
- Sample260916-h2phaagm71
- SHA256 377abc9d367e61cb5c4761bf48dcfdf5bcd3822f303e0f972d7f4c8295a2ea79
- MD5 15596b41dba42cdcce4f677fbbc86b6e
- SHA1 1ed1e69e72028150f8562bff5ca1dd745874329a
- SHA512 d4e0d64f71027ecc6d85479542ed682359b37446cb1dccce5fa2972f152e27f3cb91a8ec0dc61270bc40038751a58982d4678efb929a3bc6d3546e072f51a9f2
- SSDEEP 98304:HwBOBfKt5yLFxNTZB7ktTq8K+ly8DfIbhGSqzxm:Hw/tyd3w++lz0bym
- TLSH T1CDF5234AF7951CF4E5A3E2758AA1450BE3737C563B3093CF2760566A2F232915E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File opened for modification C:\Program Files\WinRAR\License.txt .exe File created C:\Program Files\WinRAR\Uninstall.exe .exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe .exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX .exe File opened for modification C:\Program Files\WinRAR\Zip.SFX .exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt .exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst .exe File created C:\Program Files\WinRAR\RarExtInstaller.exe .exe File created C:\Program Files\WinRAR\Zip64.SFX .exe File opened for modification C:\Program Files\WinRAR\Descript.ion .exe File created C:\Program Files\WinRAR\WinRAR.exe .exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png .exe File created C:\Program Files\WinRAR\Zip.SFX .exe File created C:\Program Files\WinRAR\Descript.ion .exe File created C:\Program Files\WinRAR\Default.SFX .exe File opened for modification C:\Program Files\WinRAR\Default64.SFX .exe File opened for modification C:\Program Files\WinRAR .exe File created C:\Program Files\WinRAR\License.txt .exe File opened for modification C:\Program Files\WinRAR\RarExt.dll .exe File created C:\Program Files\WinRAR\Resources.pri .exe File created C:\Program Files\WinRAR\Default64.SFX .exe File opened for modification C:\Program Files\WinRAR\7zxa.dll .exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll .exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix .exe File opened for modification C:\Program Files\WinRAR\Resources.pri .exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Rar.exe .exe File created C:\Program Files\WinRAR\RarExt32.dll .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png .exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png .exe File opened for modification C:\Program Files\WinRAR\Default.SFX .exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst .exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe .exe File opened for modification C:\Program Files\WinRAR\Rar.txt .exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt .exe File created C:\Program Files\WinRAR\RarExtPackage.msix .exe File created C:\Program Files\WinRAR\WinCon.SFX .exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240774593 .exe File created C:\Program Files\WinRAR\Uninstall.lst .exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe .exe File created C:\Program Files\WinRAR\RarExt.dll .exe File created C:\Program Files\WinRAR\Order.htm .exe File opened for modification C:\Program Files\WinRAR\Rar.exe .exe File created C:\Program Files\WinRAR\UnRAR.exe .exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png .exe File created C:\Program Files\WinRAR\ReadMe.txt .exe File created C:\Program Files\WinRAR\Rar.txt .exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe .exe File created C:\Program Files\WinRAR\WinCon64.SFX .exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png .exe File created C:\Program Files\WinRAR\WhatsNew.txt .exe File opened for modification C:\Program Files\WinRAR\Order.htm .exe File created C:\Program Files\WinRAR\RarFiles.lst .exe File created C:\Program Files\WinRAR\7zxa.dll .exe File created C:\Program Files\WinRAR\WinRAR.chm .exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm .exe - Executes dropped EXE 2 IoCs
pid Process 3476 uninstall.exe 1820 RarExtInstaller.exe - Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r17 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r27 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r19\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r07 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\"" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r01 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r10\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zst uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r05 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uue uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r09 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1676 .exe 1676 .exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3476 1676 .exe 87 PID 3476 wrote to memory of 1820 3476 uninstall.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
PID:1820
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WinRAR\Rar.txt
- Size 109KB
- SHA256 59334a8ffff612755a64a912389bc23fbc35933cf209f845bde34f055011b8a6
- MD5 b689a0cb8c288849febffafc2144576b
- SHA1 4cba85fa8ac528c3ac0af6356cdb912a0ae4199b
- SHA512 63e3dcae9a5a7373b7f5fdd661ae624a27e8f72ca86cb1be91533575ae115cf874bc0785350f00e919694b36b4745e6fa581252ec0d8a9ba2a99cef20e26b247
- SSDEEP 768:doxKukh1SIfjcjKJUjnc4JRb+aT9E1qYiHSGot7uj5dKiu18ewxJfkIjxDftKWkH:doxKuOKKi9bbR99S5c61Q7MaF1KWB4r
- TLSH T133B3D8277E8E1371297241965F19A199E31050EF371E129538EDC38C7F3A8A293F66EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtInstaller.exe
- Size 179KB
- SHA256 48b44bd3342a68ecbbd40a485930a22e02fdf157b2939ee346c2b123f6d5e99c
- MD5 1e1cac0725cf47e62ea96669eac678fc
- SHA1 bbce70aa9d4177e637c41673fff97c77e932d672
- SHA512 9a0f544349a0dc6c4e1335d6ec5d84d29904330c3f93c3d88f3d1daddd6499851e624532b5d3d7719e42e16267371a3cd820eb18efcdc27a3312ca5e3646b614
- SSDEEP 3072:QYMVL7FtFKSRTalv9EGPvPjTiB37HIv71F6v8oGtn9:QYMVL5vMvauPyB3o1c89
- TLSH T1E7045C47B3A521FCE567D23888924605FB7278365B708AAF1760437A5F237C1ED3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\RarExtPackage.msix
- Size 23KB
- SHA256 10a9e66b22922211668c9d9be62e309e824ca72114be9e0d090c15ba297ca787
- MD5 9301f2ad24daa60404407053635cb2ad
- SHA1 a2df6e5af472dec9594d32b9595feeb4c48c1c44
- SHA512 14ddf7c2cb464a9e5156b023efaaf428b264606cd6cf01eaf96ea0f0c192de7c7b3960c66ef67c2fed90d8a4764a0673e720fefa0300f225653f9b1fe4f6d1c2
- SSDEEP 384:LZR015ziBz4oqvhFv+qkDGm0fxPZF7SxEDHV6sZd3NsKYoZ6SWoSoI5f7Y4IyvoF:fYzMzHshFvbkDdoZw6MsZd3UOVVu7Zab
- TLSH T1F3B2C0F2F34A3A2BCB4CC1778B661D305960FE604813CD827759299846B8B790365BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\Uninstall.exe
- Size 429KB
- SHA256 fd934c3b663679041b82c12d60b14c51060d8d04742612ed5f9cfa82cccf1d37
- MD5 8e1a194cdb986b277e44afbf419d0bd7
- SHA1 c6a46bfb7e829fc710fbe668900a80efdff9c36e
- SHA512 3e64edeed5e50927e1c758e9788be5778af2ad3c52ee1cebf19dd020fe2378f2bf375f0a65bc87c3ffb4c3dc13133b4f9cd3f7d627310011e1325c1073634fa1
- SSDEEP 12288:gSXiav7Nwt8OVYPqo3YlgaAjvwBhvBJ/+5IISY1AE7:bS4qiYlFAjoBhvn/+r1z7
- TLSH T16694BE5863E80CF8E9B7923DCCA28616E6727C524B30C79F0761165B5F33690EE3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WhatsNew.txt
- Size 105KB
- SHA256 bf30a7d667b61a90bc00908317d96599386c841759540bdb74ca249e28ec8624
- MD5 c78a76e698514a835452de89025b7778
- SHA1 091869306172f2b6fab1cd47ed2d4bbf1527321c
- SHA512 8696a6c11534b588a6feda356d2f9d9ee92547fb95e899490b3f355d08fecae73fc494a7817d5ad29924c7e9e61072a963aa6e59d3724145ecd3bfdd26495f9e
- SSDEEP 1536:owXicDYb3fXxuqo3t5Vb5dMJeKLCD0TAXNG/MNWM9Lmh5BuM:tiSs5OFS40TCRyuM
- TLSH T1FCB3B6237E5A127229B242826F156256F318A1BF270642C47D7D838C7F36997D2F72F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.chm
- Size 317KB
- SHA256 9d96fddee6df94a3b6bfa731e962d31fedd4d8123aaf29c231b06f0cc10a2b2d
- MD5 6bd7d6deb6aa6c798e6e011b7eee9838
- SHA1 6766b040128e1a364e8f9f877b6ed18f37b878ce
- SHA512 8e422346cf91d4757310919a6abe67ccff60dc84ef572d76fd8863bd2201dbc1c27377c382b4bdbc71c2a2f866eb1604f01fcb0d979594c22c43cd2db8877342
- SSDEEP 6144:DOmlAJDCI/uXnxAzZYuY9Qyt7KnTQiEo4LaBfDBjU/4ftmueyUF:ZlAJ7+nxWYR97Knc1WFgwfw4UF
- TLSH T1796412199D6D4073FEC93D39E8EEB3EC775A04920655BA5A2A4F8D3060D8FCE2398711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WinRAR\WinRAR.exe
- Size 2.4MB
- SHA256 0d068a6aa2df88613e1c5c7ba412a5a5bc3cadc3f3ab4b76d10035ba8eec27bf
- MD5 928b05a72bdc940c450f059902691501
- SHA1 7931b85054c29be4cc3c9250a5dc4a821a446040
- SHA512 de47b4f9065bec41671f17f0fdd33d324e9204f323fea863774952ceaa05f17106c46ddc118c15a2fdb75d1313b6cc91b430357fa3a11d13355869507d075788
- SSDEEP 49152:mlLEkH4q8hy1JWFeIrk/agsMod2ZPybt+9ZjeLBzNwui0hBdH30U:44q8hyyCX6LBquTBpkU
- TLSH T169C5AF4663E840E8D0B7D778CA669617EBB17C525F30CB9F11A1998E1F337A09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH