Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\WinRAR\shell\open\command] '' = '"%ProgramFiles%\WinRAR\WinRAR.exe" "%1"'
- [HKLM\Software\Classes\WinRAR.ZIP\shell\open\command] '' = '"%ProgramFiles%\WinRAR\WinRAR.exe" "%1"'
- [HKLM\Software\Classes\WinRAR.REV\shell\open\command] '' = '"%ProgramFiles%\WinRAR\WinRAR.exe" "%1"'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM WinRAR.exe
Modifies file system
Creates the following files
- %TEMP%\winrar\config.inf
- %TEMP%\winrar\rarreg.key
- %TEMP%\winrar\settings.reg
- %TEMP%\winrar\settings2.reg
- %TEMP%\winrar\nircmd.exe
- %TEMP%\winrar\nsudolc.exe
- %TEMP%\winrar\setuserfta.exe
- %TEMP%\winrar\winrar_7.20_x64.exe
- %ProgramFiles%\winrar\leggimi.txt
- %ProgramFiles%\winrar\leggimi_1a.txt
- %ProgramFiles%\winrar\licenza.txt
- %ProgramFiles%\winrar\novitГ .txt
- %ProgramFiles%\winrar\ordin.htm
- %ProgramFiles%\winrar\ordina.htm
- %ProgramFiles%\winrar\rarextinstaller.exe
- %ProgramFiles%\winrar\rarextpackage.msix
- %ProgramFiles%\winrar\resources.pri
- %ProgramFiles%\winrar\default32.sfx
- %ProgramFiles%\winrar\wincon32.sfx
- %ProgramFiles%\winrar\zip32.sfx
- %ProgramFiles%\winrar\rarextlogo.altform-unplated_targetsize-32.png
- %ProgramFiles%\winrar\rarextlogo.altform-unplated_targetsize-48.png
- %ProgramFiles%\winrar\rarextlogo.altform-unplated_targetsize-64.png
- %APPDATA%\microsoft\windows\start menu\programs\winrar\guida a winrar.lnk
- %APPDATA%\microsoft\windows\start menu\programs\winrar\manuale di rar in modalitГ carattere.lnk
- %APPDATA%\microsoft\windows\start menu\programs\winrar\novitÐÂ dell'ultima versione.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\guida a winrar.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\manuale di rar in modalitГ carattere.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\novitÐÂ dell'ultima versione.lnk
- %ProgramFiles%\winrar\rarreg.key
- nul
- %APPDATA%\winrar\version.dat
- C:\users\public\desktop\winrar.lnk
Deletes following files that it created itself
- %TEMP%\winrar\config.inf
- %TEMP%\winrar\nircmd.exe
- %TEMP%\winrar\nsudolc.exe
- %TEMP%\winrar\rarreg.key
- %TEMP%\winrar\settings.reg
- %TEMP%\winrar\settings2.reg
- %TEMP%\winrar\setuserfta.exe
- %TEMP%\winrar\winrar_7.20_x64.exe
Modifies the following files
- %ProgramFiles%\winrar\descript.ion
- %ProgramFiles%\winrar\rar.txt
- %ProgramFiles%\winrar\rarfiles.lst
- %ProgramFiles%\winrar\uninstall.lst
- %ProgramFiles%\winrar\winrar.chm
- %ProgramFiles%\winrar\rarnew.dat
Substitutes the following executable files
- %ProgramFiles%\WinRAR\RarExt.dll
- %ProgramFiles%\WinRAR\RarExt32.dll
Substitutes the following files
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
- %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
Miscellaneous
Searches for the following windows
- ClassName: 'Edit' WindowName: ''
- ClassName: 'WinRarWindow' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\winrar\winrar_7.20_x64.exe' /S
- '%TEMP%\winrar\setuserfta.exe' .001 WINRAR
- '%TEMP%\winrar\setuserfta.exe' .7z WINRAR
- '%TEMP%\winrar\setuserfta.exe' .arj WINRAR
- '%TEMP%\winrar\setuserfta.exe' .bz WINRAR
- '%TEMP%\winrar\setuserfta.exe' .bz2 WINRAR
- '%TEMP%\winrar\setuserfta.exe' .cab WINRAR
- '%TEMP%\winrar\setuserfta.exe' .jar WINRAR
- '%TEMP%\winrar\setuserfta.exe' .rar WINRAR
- '%TEMP%\winrar\setuserfta.exe' .tar WINRAR
- '%TEMP%\winrar\setuserfta.exe' .taz WINRAR
- '%TEMP%\winrar\setuserfta.exe' .tbz WINRAR
- '%TEMP%\winrar\setuserfta.exe' .tbz2 WINRAR
- '%TEMP%\winrar\setuserfta.exe' .tgz WINRAR
- '%TEMP%\winrar\setuserfta.exe' .z WINRAR
- '%TEMP%\winrar\setuserfta.exe' .zip WINRAR.ZIP
- '%TEMP%\winrar\setuserfta.exe' .zipx WINRAR
- '%TEMP%\winrar\nircmd.exe' exec min %ProgramFiles%\WinRAR\WinRAR.exe
- '%TEMP%\winrar\nsudolc.exe' -U:T -P:E Reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StagingInfo\WinRAR.ShellExtension_1.0.0.2_x64__d9ma7nkbkv4rp /f
- '%TEMP%\winrar\nsudolc.exe' -U:T -P:E Reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\PackageState\S-1-5-21-908451450-3338289890-236876531-1001\WinRAR.ShellExtension_d9ma7nkbkv4rp /f
Restarts the analyzed sample
Executes the following
- '%ProgramFiles%\winrar\uninstall.exe' /setup
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection %TEMP%\WINRAR\Config.inf,DefaultInstall,1
- '<SYSTEM32>\cmd.exe' /c ping -n 1 127.0.0.1>nul
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c Copy /y "rarreg.key" "%ProgramFiles%\WinRAR"
- '%ProgramFiles%\winrar\winrar.exe'
- '<SYSTEM32>\cmd.exe' /c ping -n 4 127.0.0.1>nul
- '<SYSTEM32>\ping.exe' -n 4 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c ping -n 2 127.0.0.1>nul
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\regedit.exe' /s Settings.reg
- '<SYSTEM32>\cmd.exe' /c ping -n 3 127.0.0.1>nul
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '%WINDIR%\regedit.exe' /s Settings2.reg
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection Config.inf,DefaultInstall2,1
- '%TEMP%\winrar\winrar_7.20_x64.exe' /S' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection %TEMP%\WINRAR\Config.inf,DefaultInstall,1' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .001 WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .7z WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .arj WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .bz WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .bz2 WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .cab WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .jar WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .rar WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .tar WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .taz WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .tbz WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .tbz2 WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .tgz WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .z WINRAR' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .zip WINRAR.ZIP' (with hidden window)
- '%TEMP%\winrar\setuserfta.exe' .zipx WINRAR' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping -n 1 127.0.0.1>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Copy /y "rarreg.key" "%ProgramFiles%\WinRAR"' (with hidden window)
- '%TEMP%\winrar\nircmd.exe' exec min %ProgramFiles%\WinRAR\WinRAR.exe' (with hidden window)
- '%ProgramFiles%\winrar\winrar.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping -n 4 127.0.0.1>nul' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM WinRAR.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping -n 2 127.0.0.1>nul' (with hidden window)
- '%WINDIR%\regedit.exe' /s Settings.reg' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping -n 3 127.0.0.1>nul' (with hidden window)
- '%WINDIR%\regedit.exe' /s Settings2.reg' (with hidden window)
- '%TEMP%\winrar\nsudolc.exe' -U:T -P:E Reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StagingInfo\WinRAR.ShellExtension_1.0.0.2_x64__d9ma7nkbkv4rp /f' (with hidden window)
- '%TEMP%\winrar\nsudolc.exe' -U:T -P:E Reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\PackageState\S-1-5-21-908451450-3338289890-236876531-1001\WinRAR.ShellExtension_d9ma7nkbkv4rp /f' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection Config.inf,DefaultInstall2,1' (with hidden window)
