| File name: | winrar-x64-701.exe |
| Full analysis: | https://app.any.run/tasks/d1871e9a-f643-4dd5-9da0-293892496fe1 |
| Verdict: | Malicious activity |
| Analysis date: | August 17, 2024, 01:05:30 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5: | 3A2F16A044D8F6D2F9443DFF6BD1C7D4 |
| SHA1: | 48C6C0450AF803B72A0CAA7D5E3863C3F0240EF1 |
| SHA256: | 31F7BA37180F820313B2D32E76252344598409CB932109DD84A071CD58B64AA6 |
| SSDEEP: | 98304:7q69dX60Chz9WEoHgfIjZLanqlELE7FQYF98F3nLsOAnKn7D2XBNUf29hy6VbJ0C:KKN7ULOzua |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- winrar-x64-701.exe (PID: 6496)
Reads Microsoft Outlook installation path
- winrar-x64-701.exe (PID: 6496)
Reads the date of Windows installation
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Reads security settings of Internet Explorer
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Drops 7-zip archiver for unpacking
- winrar-x64-701.exe (PID: 6496)
Reads Internet Explorer settings
- winrar-x64-701.exe (PID: 6496)
Executable content was dropped or overwritten
- winrar-x64-701.exe (PID: 6496)
Creates/Modifies COM task schedule object
- Uninstall.exe (PID: 6328)
Creates a software uninstall entry
- Uninstall.exe (PID: 6328)
Searches for installed software
- Uninstall.exe (PID: 6328)
Start notepad (likely ransomware note)
- Uninstall.exe (PID: 6328)
INFO
Checks supported languages
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Process checks Internet Explorer phishing filters
- winrar-x64-701.exe (PID: 6496)
Creates files in the program directory
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Checks proxy server information
- winrar-x64-701.exe (PID: 6496)
Reads the computer name
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Creates files or folders in the user directory
- Uninstall.exe (PID: 6328)
Process checks computer location settings
- winrar-x64-701.exe (PID: 6496)
- Uninstall.exe (PID: 6328)
Reads Microsoft Office registry keys
- Uninstall.exe (PID: 6328)
Reads security settings of Internet Explorer
- notepad.exe (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:05:12 10:17:26+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.33 |
| CodeSize: | 270848 |
| InitializedDataSize: | 313344 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x29e90 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 7.1.0.0 |
| ProductVersionNumber: | 7.1.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| ProductName: | WinRAR |
| CompanyName: | Alexander Roshal |
| FileDescription: | WinRAR |
| FileVersion: | 7.1.0 |
| ProductVersion: | 7.1.0 |
| InternalName: | WinRAR |
| LegalCopyright: | Copyright © Alexander Roshal 1993-2024 |
| OriginalFileName: | WinRAR.exe |
Total processes
123
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3568 | "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Program Files\WinRAR\License.txt | C:\Windows\System32\notepad.exe | — | Uninstall.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Notepad Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6328 | "C:\Program Files\WinRAR\uninstall.exe" /setup | C:\Program Files\WinRAR\Uninstall.exe | — | winrar-x64-701.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: HIGH Description: Uninstall WinRAR Version: 7.1.0 Modules
| |||||||||||||||
| 6444 | "C:\Users\admin\Desktop\winrar-x64-701.exe" | C:\Users\admin\Desktop\winrar-x64-701.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR Exit code: 3221226540 Version: 7.1.0 Modules
| |||||||||||||||
| 6496 | "C:\Users\admin\Desktop\winrar-x64-701.exe" | C:\Users\admin\Desktop\winrar-x64-701.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: HIGH Description: WinRAR Exit code: 0 Version: 7.1.0 Modules
| |||||||||||||||
Total events
4 136
Read events
4 028
Write events
104
Delete events
4
Modification events
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX |
| Operation: | write | Name: | C%%Program Files%WinRAR |
Value: C:\Program Files\WinRAR | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry |
| Operation: | delete value | Name: | AddToFavoritesInitialSelection |
Value: | |||
| (PID) Process: | (6496) winrar-x64-701.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry |
| Operation: | delete value | Name: | AddToFeedsInitialSelection |
Value: | |||
Executable files
13
Suspicious files
11
Text files
11
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6496 | winrar-x64-701.exe | — | ||
MD5:— | SHA256:— | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\ReadMe.txt | text | |
MD5:00D0A57A6D64EE3DE8F4D5529D6C6447 | SHA256:FCD13E1B97AF47B8B923BA97AE15E9731C66093609667C3171D5DD24A6F7F2E6 | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\Descript.ion | text | |
MD5:84846ABC52DC17020E4E934D3C94B4E6 | SHA256:3449FD40D054C96285FAB92011E732174C7CD000EDA67470376F26F0D431F1F2 | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\Rar.exe | executable | |
MD5:16659AE52CE03889AD19DB1F5710C6AA | SHA256:0B1866B627D8078D296E7D39583C9F856117BE79C1D226B8C9378FE075369118 | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\License.txt | text | |
MD5:672064CF19DB0B083B981CF0BE7662B0 | SHA256:9FC8AA33CCAFA04C1CE4C0A61047B341297D720ADAB1B77F67B5FE59F43BB59F | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\WinRAR.chm | binary | |
MD5:6CA1BC8BFE8B929F448E1742DACB8E7F | SHA256:997184B6F08D36DEDC2CD12EE8DC5AFB5E6E4BF77F7AB10F7ADE9EEFDB163344 | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\WhatsNew.txt | text | |
MD5:1C44C85FDAB8E9C663405CD8E4C3DBBD | SHA256:33108DD40B4E07D60E96E1BCFA4AD877EB4906DE2CC55844E40360E5D4DAFB5D | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\UnRAR.exe | executable | |
MD5:98CCD44353F7BC5BAD1BC6BA9AE0CD68 | SHA256:E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\Zip32.SFX | executable | |
MD5:E0A8B12266260CB8597D0D5ECAE30362 | SHA256:6EA28B1B5DA1D2F13DC3787D1348934F0C2BF6A186535D691818FD9FE8A90294 | |||
| 6496 | winrar-x64-701.exe | C:\Program Files\WinRAR\RarFiles.lst | text | |
MD5:E70E22D45ECB35217D66A4CE30F081FA | SHA256:9EB1099D7231CD24D8740609D3AC6985139F2334730356DF983AB01D7896AD6F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
15
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1076 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4100 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4324 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |