f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df

General

Target

f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Size

1.1MB
MD5

3f8ce7acfbecd2c1b13162716acecf00
SHA1

7660c3d4fefbc1698d19252dc1c142a4c444d71b
SHA256

f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df
SHA512

340e1846a6c2339ca0a8c954a9e0c38e9d887cde4836069f02bc8a6904905d1203f2c7203a5d6d57bdd24e6edc62c2f553a166b9c37ba53717a2e5010cdbd302
SSDEEP

24576:YH0OPKc3APvIqGLiit8TFxw+xhweTALScnMMMMMMlQQ2zl:/kHoIjLiiifxOeTA2GMMMMMMQl

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

pid process

1600 f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

pid	process
1600	f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe

C:\Users\Admin\AppData\Local\Temp\f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe
"C:\Users\Admin\AppData\Local\Temp\f99fb80b66a4266c8dc068001a38aec0068cc9cd412612e4956f2a2477e122df.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download
memory/1600-56-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing