WinRAR.exe

Top Paths

• C:\Program Files\WinRAR92.26%
• C:\Program Files (x86)\WinRAR7.74%

Top Hashes (SHA256)

• a1290e4f7bedc8c7c0c2519bd005caf7fe0210dd374490016e51ed2381731af170.8%
• 129270762bb9e9aba7c21b7653570026b020ec761275cd712246d40ba20a5e318.61%
• b908109795e2bae549c34e8011e4e128207af90502b1129f0487310ef615ab3f4.38%
• 707a67adb33243d56156ae8bcaf9727e2ee7c51eac1997d88ee15cac138405383.72%
• 546945173f834b5205c8b25d40e155508c432c9a49aba1760a70f0ccd08721603.36%
• b14e0630c1040ce9236f44b0c1aff942be9bb996f5d26a10e388846312c9eddc2.12%
• 845c8bd18b84b892932e4cc48eca71786a4016b7de166261732393d4441f5a052.04%
• 492404a16bb299b23bbe0cb08ed6a7d71bd370dc51393f6845d00726bf4fbc2e1.75%
• 5a8429930b0bc1ec3da922adf4e29c02a49267cc85efe41eb7ffb7a1f39c7eec0.95%
• 74055963c95cd3a879a2e7d7da53c4aea0cb029032e8149fed02dd13560631120.8%
• 130d6b728ba6f4b129c84cd3a6ee0b71a11219f813c4df181fb6823ffba7f484

Top Grandparents

• userinit.exe79.35%
• explorer.exe15.12%
• WerFault.exe1.63%
• svchost.exe1.14%
• chrome.exe0.57%
• OUTLOOK.EXE0.57%
• KeePass.exe0.41%
• OneDrive.exe0.41%
• updater.exe0.41%
• BackgroundTransferHost.exe0.16%
• cmd.exe

Top Parents

• explorer.exe79.64%
• chrome.exe9.69%
• OUTLOOK.EXE5.16%
• firefox.exe2.37%
• iexplore.exe0.77%
• WinRAR.exe0.77%
• browser_broker.exe0.7%
• Unity.exe0.35%
• RuntimeBroker.exe0.21%
• sihost.exe0.14%
• powershell.exe
• cmd.exe

Top Children

• notepad.exe31.68%
• VISIO.EXE9.16%
• chrome.exe7.25%
• FoxitPhantomPDF.exe6.11%
• FoxitReader.exe5.73%
• WINWORD.EXE4.2%
• EXCEL.EXE3.44%
• WinRAR.exe3.44%
• AcroRd32.exe2.67%
• Wireshark.exe2.67%
• rarextinstaller.exe

What does WinRAR.exe normally do?

WinRAR is a commercial archive manager used to create and extract RAR/ZIP and many other archive formats, with GUI (WinRAR.exe), console (Rar.exe, UnRAR.exe) and shell-integration components. In the lab, the signed installer winrar-x64-723.exe ran silently with /S from PowerShell, wrote the expected file set to C:\Program Files\WinRAR (WinRAR.exe, Rar.exe, UnRAR.exe, RarExt*.dll, *.SFX stubs, RarExtPackage.msix), and launched Uninstall.exe /setup which in turn ran RarExtInstaller.exe -install to register the Explorer context-menu handler; RarExtInstaller.exe was also seen launched by explorer.exe with /install /local and made a single outbound HTTP connection (23.11.32.159:80, consistent with certificate/OCSP or rarlab lookup, with www.rarlab.com in DNS). WinRAR.exe was then exercised from PowerShell for archive create and extract ("a -ibck -y ..." and "x -ibck -y ..."), and Rar.exe/UnRAR.exe ran interactively spawning only conhost.exe. Extensive HKCR file-association writes (.rar, .zip, .7z, .tar, .iso-class extensions, ShellNew, CLSID/AppID entries) are expected installer behavior; no autorun entries were created, and the bulk of observed network traffic belonged to unrelated Windows telemetry/Store processes.

When is WinRAR.exe suspicious?

Archiving invocations from non-interactive or unusual parents (cmd.exe/powershell.exe launched by w3wp.exe, services.exe, WMI, PsExec, Office apps, or a remote-access tool) especially with password and split-volume switches: rar.exe a -r -hp<password> -v100m -ta<date> -m5 targeting user profile, mailbox, share, or database paths. Rar.exe/UnRAR.exe copied out of C:\Program Files\WinRAR and renamed (e.g. svchost.exe, a.exe, r.exe) or dropped into C:\Users\Public, %TEMP%, %ProgramData%, or ADMIN$ shares — attackers routinely ship a standalone rar.exe. WinRAR.exe or the RarExt shell handler spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe or an unsigned EXE from a C:\Users\<u>\AppData\Local\Temp\Rar$*\ directory — the hallmark of CVE-2023-38831 spoofed-extension archives. Extraction that writes into Startup folders, %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, or paths containing ..\ / ADS-style traversal (CVE-2018-20250 ACE, CVE-2025-8088 alternate-data-stream traversal). Self-extracting archives (SFX) executing with setup/silent parameters from Downloads or Temp, or newly written *.SFX-derived EXEs outside the WinRAR directory. Large multi-volume .rar/.r00 parts appearing in staging directories immediately before egress to cloud storage or FTP.

How do attackers abuse WinRAR.exe?

WinRAR's console binary is a staple LOLBin for collection and exfiltration staging: APT groups (APT28/Fancy Bear, APT29, APT41, FIN7, Lazarus, Conti/LockBit affiliates) routinely drop a standalone rar.exe and run `rar a -r -hp<password> -v<size> -ta<date>` to compress and encrypt stolen documents into split, password-protected volumes that defeat AV and DLP content inspection before upload to MEGA/Dropbox/FTP. WinRAR itself has been repeatedly weaponized for initial access: CVE-2023-38831 (extension-spoofing in ZIP/RAR — opening a decoy file executes a same-named script from a sibling folder, used by Sandworm, APT28, APT29, Konni, DarkPink and crimeware against traders); CVE-2018-20250 (UNACEV2.dll ACE path traversal writing payloads into the Startup folder, used by MuddyWater and many commodity families); CVE-2025-8088 (RomCom-exploited NTFS alternate-data-stream path traversal in RAR extraction dropping payloads to Startup); and CVE-2025-31334 (Mark-of-the-Web bypass on symlinked executables inside archives). SFX stubs (Default.SFX/WinCon.SFX and third-party sfx builders) are widely used to wrap droppers and to run embedded 'Setup' commands, giving a signed-looking self-extractor that silently writes and launches malware; ransomware crews also use SFX/rar for password-protected payload delivery in phishing to evade gateway scanning. Legitimate installs are also abused for masquerading — attackers name malware WinRAR.exe or place a trojanized rar.exe in a WinRAR-looking directory — and cracked/keygen WinRAR builds bundled with infostealers remain a common commodity infection vector.

Detection guidance

Baseline WinRAR execution from C:\Program Files\WinRAR with parents explorer.exe, cmd.exe or a user shell, then alert on rar.exe/winrar.exe/unrar.exe running from any other path, under a renamed image (match on OriginalFileName Rar.exe/WinRAR.exe/UnRAR.exe with mismatched process name), or with parent processes tied to servers, service accounts, Office, or remote-execution frameworks. Hunt command lines containing -hp, -p (with value), -v, -ta/-tn, -m5, -r combined with paths such as \Users\, \Documents\, \Mail\, \Backup\ or UNC shares, and correlate archive creation with outbound transfers or large uploads within minutes. Monitor process creation where the parent is WinRAR.exe or an image path under Temp\Rar$* — any script host, LOLBin, or unsigned child there should be treated as likely CVE-2023-38831 exploitation — and alert on file writes into Startup folders whose creating process is WinRAR.exe/UnRAR.exe. Track WinRAR version inventory and flag hosts below the patched release (7.13+ for the ADS traversal, 6.23+ for the extension-spoofing bug), and validate that WinRAR.exe, Rar.exe and RarExtInstaller.exe carry a valid win.rar GmbH signature.

MITRE ATT&CK techniques

References

• https://www.win-rar.com/
• https://www.rarlab.com/