RomCom

Scenario

In this Sherlock, Players will analyze a system that was the target of an exploit in the Winrar application and was abused by groups like RomCom and Paper WereWolf in 2025.

Executive Summary

A user opened a booby-trapped RAR archive that exploited a WinRAR path traversal flaw, the same bug RomCom and Paper Werewolf used in 2025. Within about fourteen seconds of the archive opening, the exploit wrote a decoy document next to the archive, a backdoor into the user’s local AppData, and a shortcut into the Startup folder so the backdoor would relaunch at every logon. The user then opened the decoy, believing it was a legitimate lab result, while the backdoor was already in place. The only evidence is the NTFS $MFT and $J journal, so the whole chain is rebuilt from creation timestamps and USN records; no file contents are available.

Artifacts

• KAPE VHDX: one .vhdx holding only the C: drive’s $MFT and $J. No live files, no LNK contents, no prefetch. Convert it to a raw image first, then carve the two metadata files
• Parsed output: MFTECmd CSVs for $MFT and $J → read with grep or Python

Gotcha: 7-Zip extracts 0 bytes from the VHDX, so convert it with qemu-img instead. The NTFS boot sector inside has a zeroed jump field, so neither 7-Zip nor ntfs-3g will mount the partition. Walk the $MFT data runs yourself to carve out $MFT and $J.

Timestamp note: Answers need YYYY-MM-DD hh:mm:ss, so drop the fractional seconds from the MFT and USN values.

qemu-img convert -O raw evidence.vhdx work/disk.raw

MFTECmd -f MFT_C.bin --csv work --csvf mftc.csv

MFTECmd -f J_C.bin --csv work --csvf j.csv

Initial Access

Reference lookup, no evidence needed. ESET’s research on RomCom and others exploiting a WinRAR zero-day in 2025 (welivesecurity.com) names the CVE.

Same ESET article. The flaw abuses NTFS alternate data streams in archive entry names so files are extracted to an attacker-chosen path instead of the folder the user picked, which is what lets the payloads land in Startup and AppData.

Search the parsed $MFT for .rar entries under Susan’s profile. Only one archive sits in \Users\susan\Documents (MFT entry 117119), and its name reads like a lure aimed at a medical or lab worker.

grep -i 'susan' work/mftc.csv | grep -i '\.rar'

From Q3, take entry 117119 and read the $STANDARD_INFORMATION created time (Created0x10 in the MFTECmd output). It reads 08:13:50.519; truncate to the second.

grep 'Pathology-Department-Research-Records.rar' work/mftc.csv

Execution

Opening a file makes Explorer drop a shortcut in the user’s Recent items. Look for the Recent LNK named after the archive in Susan’s profile; its creation time is the first open. It lands at 08:14:04.996, about 14 seconds after the archive hit the disk.

grep -i 'Recent' work/mftc.csv | grep 'Pathology-Department-Research-Records'

Filter the USN journal for FileCreate records in the seconds after the Q5 open. A PDF appears in Susan’s Documents folder at 08:14:18.79, a burst that only an extraction could produce. Its name fits the lure from Q3.

grep FileCreate work/j.csv | grep '2025-09-02 08:14:1'

Same Recent items trick as Q5, this time for the decoy from Q6. The LNK for the PDF was created at 08:15:05.61, about 47 seconds after the PDF was dropped. The backdoor had been in place for most of a minute by then.

grep -i 'Recent' work/mftc.csv | grep 'Genotyping_Results_B57_Positive'

Same USN window as Q6. An executable is created under \Users\susan\AppData\Local at 08:14:18.85, a few hundredths of a second after the decoy. Nothing else in that burst is an executable, and the evidence holds no file contents, so the attribution rests on timing and location rather than analysis of the binary. The directory is a classic spot for a user-writable implant, and the name imitates a helper process.

grep FileCreate work/j.csv | grep -i '\.exe'

Persistence

Search the $MFT for anything under Susan’s Start Menu\Programs\Startup folder. A single .lnk with a harmless name (MFT entry 117404) sits there, created inside the same burst as the backdoor from Q7. Anything in Startup runs at logon, so the shortcut relaunches the backdoor.

grep -i 'Startup' work/mftc.csv | grep -i 'susan'

Reference lookup against ATT&CK, no evidence needed. A shortcut planted to run at logon maps to the shortcut-specific sub-technique under Boot or Logon Autostart Execution.

Gotcha: The generic Startup folder sub-technique (T1547.001) is the obvious pick and it is wrong here. The file is a .lnk, so the shortcut sub-technique is the one that matches.

Attack Summary

Phase	Action
Initial Access	Susan receives Pathology-Department-Research-Records.rar and it lands in her Documents folder
Execution	Archive opened in WinRAR; the path traversal flaw fires
Execution	Decoy PDF extracted beside the archive
Execution	Backdoor ApbxHelper.exe written to AppData\Local
Persistence	Display Settings.lnk written to the Startup folder
Execution	User opens the decoy PDF, unaware of the backdoor

Forensic Timeline

Timestamp	Event
2025-09-02 08:13:50	Pathology-Department-Research-Records.rar created on disk
2025-09-02 08:14:04	Recent items LNK for the archive created (archive opened)
2025-09-02 08:14:18.79	Decoy PDF created in Documents
2025-09-02 08:14:18.85	ApbxHelper.exe created in AppData\Local
2025-09-02 08:15:05	Recent items LNK for the decoy created (decoy opened)

IOCs

Type	Value
File (archive)	C:\Users\susan\Documents\Pathology-Department-Research-Records.rar
File (decoy)	C:\Users\susan\Documents\Genotyping_Results_B57_Positive.pdf
File (backdoor)	C:\Users\susan\AppData\Local\ApbxHelper.exe
File (persistence)	C:\Users\susan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Display Settings.lnk
CVE	CVE-2025-8088

MITRE ATT&CK

Technique	ID	Description
Exploitation for Client Execution	T1203	WinRAR path traversal (CVE-2025-8088) triggered by opening the archive
User Execution: Malicious File	T1204.002	Archive and decoy PDF opened by the user
Ingress Tool Transfer	T1105	ApbxHelper.exe written to the user’s AppData\Local folder
Boot or Logon Autostart Execution: Shortcut Modification	T1547.009	Display Settings.lnk in the Startup folder

Defender Takeaways

Patch WinRAR. CVE-2025-8088 needs nothing more than the user opening an archive, and the fixed release closes the traversal. Archive tools rarely sit in patch-management scope, so they stay vulnerable long after the OS is current.

Alert on executables and shortcuts written to AppData and Startup right after an archive is opened. Here the archive open, the backdoor and the persistence shortcut all happened within about 15 seconds. A rule that correlates an archiver process with file creates in those paths catches it.

Watch the Startup folder. A .lnk named Display Settings is easy to miss by eye. New files under Start Menu\Programs\Startup are rare enough to alert on directly.

Keep $MFT and $J in triage collections. With no other artifacts, creation times and the USN journal were enough to rebuild the full timeline. They are small, and they survive when LNKs and prefetch are not collected.

Conclusion

A single archive open gave the actor a backdoor and logon persistence with no further user action, and the decoy PDF hid it by giving the user something to read. Filesystem metadata alone was enough to reconstruct the whole chain, which makes new-file monitoring in AppData and Startup the cheapest detection for this exploit.