But what exactly does Ransom32 exploit? A vulnerability in WinRAR or in Windows? Or does it rely on wrong user behavior?
The best description I could find:
The malware uses the script language implemented in WinRAR to automatically unpack the content of the archive into the user’s temporary files directory and execute the “chrome.exe” file contained in the archive.
Once Ransom32 arrives on a system and is executed [by whom? the .rar itself?], it will first unpack all its files into the temporary files folder. From there it copies itself into the “%AppData%\Chrome Browser” directory. It uses the bundled “s.exe” file to create a shortcut in the user’s Startup folder named “ChromeService” that will make sure the malware is being executed on every boot.
So to me, it sounds like an attack works like this:
- User downloads a .rar file
- User opens the file (or does it open itself?)
- The .rar file decides for itself where to extract to
- The .rar file executes a .exe file (or must the user execute it?)
- The executed file will copy/link itself to a specific location, so that it is started on every boot
Is this a correct summary?
If it is, it would seem to me as if steps 3. to 5. really shouldn't be happening[*]. Does Ransom32 exploit some known vulnerability in Windows or WinRAR? Or is this desired behavior, and did I misunderstand how the ransomware affects the system?
[*] I'm not that familiar with Windows security, but it doesn't seem like a good idea to let a .rar file decide for itself where it wants to be extracted to, or to let a .rar file execute .exe files.