Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 2

• General
  • The input sample is signed with an invalid certificate

    details

    Error: A certificate was explicitly revoked by its issuer. (0x800b010c)

    source

    Certificate Data

    relevance

    10/10

    ATT&CK ID

    T1116 (Show technique in the MITRE ATT&CK™ matrix)

• System Security
  • Modifies System Certificates Settings

    details

    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4")
    "WinRAR.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"; Key: "BLOB")
    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "E6A3B45B062D509B3382282D196EFE97D5956CCB")
    "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

• Suspicious Indicators 20

• Anti-Reverse Engineering
  • PE file has unusual entropy sections

    details

    .rsrc with unusual entropies 7.25320212871

    source

    Static Parser

    relevance

    10/10

• Environment Awareness
  • Reads the active computer name

    details

    "WinRAR.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the cryptographic machine GUID

    details

    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• External Systems
  • Found an IP/URL artifact that was identified as malicious by at least one reputation engine

    details

    1/80 reputation engines marked "http://crl.sectigo.com" as malicious (1% detection rate)
    1/80 reputation engines marked "https://sectigo.com" as malicious (1% detection rate)

    source

    External System

    relevance

    10/10

• Installation/Persistence
  • Modifies auto-execute functionality by setting/creating a value in the registry

    details

    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS")
    "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "0000"), "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS"), "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "0000"), "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "WinRAR.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1060 (Show technique in the MITRE ATT&CK™ matrix)

  • Modifies the open verb of a shell class

    details

    "WinRAR.exe" (Path: "HKCR\SOFTWARE\CLASSES\WINRAR\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""C:\WinRAR.exe" "%1""), "WinRAR.exe" (Path: "HKCR\SOFTWARE\CLASSES\WINRAR.ZIP\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""C:\WinRAR.exe" "%1""), "WinRAR.exe" (Path: "HKCR\SOFTWARE\CLASSES\WINRAR.REV\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""C:\WinRAR.exe" "%1"")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Writes a file to the start menu

    details

    "WinRAR.exe" wrote to file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk"

    source

    API Call

    relevance

    10/10

• Network Related
  • Sends traffic on typical HTTP outbound port, but without HTTP header

    details

    TCP traffic to 51.195.68.173 on port 443 is sent without HTTP header
    TCP traffic to 23.63.75.137 on port 80 is sent without HTTP header

    source

    Network Traffic

    relevance

    5/10

    ATT&CK ID

    T1043 (Show technique in the MITRE ATT&CK™ matrix)

• System Destruction
  • Possibly checks for the presence of an adware detecting tool

    details

    "bin\clamscan.exe" (Indicator: "clamscan.exe")

    source

    File/Memory

    relevance

    3/10

    ATT&CK ID

    T1063 (Show technique in the MITRE ATT&CK™ matrix)

• System Security
  • Modifies Software Policy Settings

    details

    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")
    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Modifies proxy settings

    details

    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "WinRAR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
    "WinRAR.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Queries sensitive IE security settings

    details

    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Queries the display settings of system associated file extensions

    details

    "WinRAR.exe" (Access type: "QUERYVAL"; Path: "HKCR\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\SYSTEM"; Key: "ALWAYSSHOWEXT"; Value: "0000000001000000020000000000")

    source

    Registry Access

    relevance

    7/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Imports suspicious APIs

    details

    RegCreateKeyExW
    RegCloseKey
    RegDeleteKeyW
    OpenProcessToken
    RegOpenKeyExW
    RegEnumKeyExW
    RegDeleteValueW
    GetDriveTypeW
    FindFirstFileW
    GetFileAttributesW
    GetCommandLineW
    OpenFileMappingW
    UnhandledExceptionFilter
    GetTempPathW
    DeviceIoControl
    CopyFileW
    GetModuleFileNameW
    IsDebuggerPresent
    GetVersionExA
    GetModuleFileNameA
    LoadLibraryExW
    CreateThread
    ExitThread
    TerminateProcess
    GetModuleHandleExW
    LoadLibraryW
    GetVersionExW
    GetTickCount
    GetFileSize
    GetStartupInfoW
    CreateDirectoryW
    DeleteFileW
    GetProcAddress
    CreateFileMappingW
    WriteFile
    FindFirstFileExA
    FindNextFileW
    FindNextFileA
    CreateFileW
    LockResource
    GetCommandLineA
    MapViewOfFile
    GetModuleHandleW
    FindResourceW
    Sleep
    ShellExecuteW
    ShellExecuteExW
    GetCursorPos
    GetLastActivePopup
    FindWindowW
    FindWindowExW
    GetWindowThreadProcessId

    source

    Static Parser

    relevance

    1/10

  • Installs hooks/patches the running process

    details

    "WinRAR.exe" wrote bytes "e739d677e1a6da772e71da77ee29da7785e2d5776da0da779064d9773ad5e07726e4d577d16dda77003dd877804bd87700000000ad373c768b2d3c76b6413c7600000000" to virtual address "0x75611000" (part of module "WSHIP6.DLL")
    "WinRAR.exe" wrote bytes "75dcfb75273efb7551c1f975ee9cf9759498f9750fb3ff751099f9759097f9750000000042c6ad77152ead77c0d9ad771bf7ad77c108af77e0c2ad7736daad7730c6ad77d5d9ad7786c4ad7700000000" to virtual address "0x7046E000" (part of module "MSLS31.DLL")
    "WinRAR.exe" wrote bytes "d5d9ad7730c6ad77e0c2ad7742c6ad7710c6ad77acdcad77a0dfad7736daad7787f1ad770000000091774f77c0904f777f6f4f771ffa4f77def44f77f2824f77857d4f7700000000" to virtual address "0x72391000" (part of module "MSIMG32.DLL")
    "WinRAR.exe" wrote bytes "c04ed8772054d977e065d977b538da770000000000d0ad7700000000c5eaad770000000088eaad7700000000e968ef758228da77ee29da7700000000d269ef75000000007dbbad770000000009beef7500000000ba18ad7700000000" to virtual address "0x77EA1000" (part of module "NSI.DLL")
    "WinRAR.exe" wrote bytes "fae6d577e1a6da772e71da77ee29da7785e2d5776da0da7726e4d577d16dda77003dd877804bd87700000000ad373c768b2d3c76b6413c7600000000" to virtual address "0x750C1000" (part of module "WSHTCPIP.DLL")

    source

    Hook Detection

    relevance

    10/10

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads information about supported languages

    details

    "WinRAR.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Hiding 4 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 20

• Environment Awareness
  • Queries volume information

    details

    "WinRAR.exe" queries volume information of "C:\share" at 00063955-00003664-0000010C-3199867

    source

    API Call

    relevance

    2/10

    ATT&CK ID

    T1120 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the registry for installed applications

    details

    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINRAR.EXE")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINRAR.EXE")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent" (SID: 2027390, Rev: 3, Severity: 3) categorized as "Unknown Traffic"
    Detected alert "ET INFO Windows OS Submitting USB Metadata to Microsoft" (SID: 2025275, Rev: 3, Severity: 3) categorized as "Misc activity"

    source

    Suricata Alerts

    relevance

    10/10

  • Sample was identified as clean by Antivirus engines

    details

    0/71 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Accesses Software Policy Settings

    details

    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Accesses System Certificates Settings

    details

    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")
    "WinRAR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Contacts domains

    details

    "isrg.trustid.ocsp.identrust.com"
    "notifier.win-rar.com"
    "ocsp.int-x3.letsencrypt.org"
    "ocsp.sectigo.com"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "51.195.68.173:443"
    "23.63.75.137:80"

    source

    Network Traffic

    relevance

    1/10

  • Contains PDB pathways

    details

    "D:\Projects\WinRAR\build\winrar32\Release\WinRAR.pdb"

    source

    File/Memory

    relevance

    1/10

  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\WinRAR_Busy"
    "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\!IECompat!Mutex"
    "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex"
    "!IECompat!Mutex"
    "Local\ZonesLockedCacheCounterMutex"
    "WinRAR_Busy"
    "Local\MSIMGSIZECacheMutex"
    "Local\ZonesCacheCounterMutex"

    source

    Created Mutant

    relevance

    3/10

  • GETs files from a webserver

    details

    "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: isrg.trustid.ocsp.identrust.com"

    source

    Network Traffic

    relevance

    5/10

  • Loads rich edit control libraries

    details

    "WinRAR.exe" loaded module "%WINDIR%\System32\riched20.dll" at 6F150000

    source

    Loaded Module

    ATT&CK ID

    T1179 (Show technique in the MITRE ATT&CK™ matrix)

  • Overview of unique CLSIDs touched in registry

    details

    "WinRAR.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}")
    "WinRAR.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}")
    "WinRAR.exe" touched "PSFactoryBuffer" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}")
    "WinRAR.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS")
    "WinRAR.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")
    "WinRAR.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS")
    "WinRAR.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS")
    "WinRAR.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS")
    "WinRAR.exe" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS")
    "WinRAR.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS")
    "WinRAR.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32")
    "WinRAR.exe" touched "Sharing Overlay (Private)" (Path: "HKCU\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\INPROCSERVER32")
    "WinRAR.exe" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER")
    "WinRAR.exe" touched "PortableDeviceManager Class" (Path: "HKCU\CLSID\{0AF10CEC-2ECD-4B92-9581-34F6AE0637F3}\TREATAS")
    "WinRAR.exe" touched "Portable Media Devices" (Path: "HKCU\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER")
    "WinRAR.exe" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER")
    "WinRAR.exe" touched "EnumEnhancedStorageACT Class" (Path: "HKCU\CLSID\{FE841493-835C-4FA3-B6CC-B4B2D4719848}\TREATAS")
    "WinRAR.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER")
    "WinRAR.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32")
    "WinRAR.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER")

    source

    Registry Access

    relevance

    3/10

  • Reads Windows Trust Settings

    details

    "WinRAR.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • The input sample is signed with a certificate

    details

    The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information)
    The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information)
    The input sample is signed with a certificate issued by "CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 48:90:4B:34:D5:56:95:C8:FD:EF:D3:3A:2C:F0:7E:C8:9B:E9:A6:ED; see report for more information)
    The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information)
    The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)

    source

    Certificate Data

    relevance

    10/10

    ATT&CK ID

    T1116 (Show technique in the MITRE ATT&CK™ matrix)

• Installation/Persistence
  • Dropped files

    details

    "WinRAR.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Archive ctime=Sat Nov 14 10:45:49 2020 mtime=Sat Nov 14 10:45:49 2020 atime=Sat Nov 14 10:46:05 2020 length=2364368 window=hide"
    "dnserrordiagoff_1_" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "467D040AEE675C1153A407D244628A1F" has type "data"
    "ErrorPageTemplate_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "version.dat" has type "data"
    "background_gradient_1_" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 1x800 frames 3"
    "NewErrorPageTemplate_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "httpErrorPagesScripts_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 4776 bytes 1 file"
    "info_48_1_" has type "PNG image data 47 x 48 8-bit/color RGBA non-interlaced"
    "navcancl_1_" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08" has type "data"
    "bullet_1_" has type "PNG image data 15 x 15 8-bit colormap non-interlaced"
    "errorPageStrings_1_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "errorPageStrings_2_" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"
    "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"

    source

    Binary File

    relevance

    3/10

  • Touches files in the Windows directory

    details

    "WinRAR.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
    "WinRAR.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui"
    "WinRAR.exe" touched file "C:\Windows\System32\imageres.dll"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk"
    "WinRAR.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\dnserrordiagoff[1]"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Network Shortcuts\desktop.ini"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Network Shortcuts"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk\desktop.ini"
    "WinRAR.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR"
    "WinRAR.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk\desktop.ini"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files"
    "WinRAR.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"
    "WinRAR.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\NewErrorPageTemplate[1]"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"
    Pattern match: "http://ocsp.thawte.com0"
    Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0"
    Pattern match: "http://ts-ocsp.ws.symantec.com07"
    Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0"
    Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0"
    Pattern match: "https://sectigo.com/CPS0"
    Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s"
    Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#"
    Pattern match: "http://ocsp.sectigo.com0"
    Pattern match: "crl.comodoca.com/AAACertificateServices.crl04"
    Pattern match: "http://ocsp.comodoca.com0"
    Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v"
    Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%"
    Pattern match: "http://ocsp.usertrust.com0"
    Pattern match: "https://d.symcb.com/cps0%"
    Pattern match: "https://d.symcb.com/rpa0"
    Pattern match: "http://s.symcd.com06"
    Pattern match: "http://s.symcb.com/universal-root.crl0"
    Pattern match: "https://d.symcb.com/rpa0@"
    Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0"
    Pattern match: "http://ts-ocsp.ws.symantec.com0"
    Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0"
    Pattern match: "https://www.win-rar.comIhttps://www.win-rar.com/buyredirect.html?L=0&BL=0&src=wrr&arch=32&ver=591"
    Pattern match: "https://www.rarlab.com/themes.htm"
    Heuristic match: "isrg.trustid.ocsp.identrust.com"
    Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: isrg.trustid.ocsp.identrust.com"
    Heuristic match: "notifier.win-rar.com"
    Heuristic match: "ocsp.int-x3.letsencrypt.org"
    Heuristic match: "ocsp.sectigo.com"
    Pattern match: "http://www.w3.org/TR/html4/loose.dtd"
    Pattern match: "ieframe.dll/ErrorPageTemplate.css"
    Pattern match: "ieframe.dll/errorPageStrings.js"
    Pattern match: "ieframe.dll/httpErrorPagesScripts.js"
    Pattern match: "ieframe.dll/info_48.png"
    Pattern match: "ieframe.dll/bullet.png"

    source

    File/Memory

    relevance

    10/10

• System Security
  • Creates or modifies windows services

    details

    "WinRAR.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "e43e88150b6e603a46f51a1d7c91f8acd18a083000feb5a858b59ebfb9044310.bin" was detected as "VC8 -> Microsoft Corporation"

    source

    Static Parser

    relevance

    10/10

    ATT&CK ID

    T1045 (Show technique in the MITRE ATT&CK™ matrix)

File Metadata

• File Compositions
• Imported Objects
• File Analysis

File Sections

File Resources