7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Size

2.5MB
MD5

53d09a55a9927bfd26313c1c2333d0e9
SHA1

be74cab37892cffdc6c95a2ed53fe4159406547c
SHA256

7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3
SHA512

dbf84f5864ebff448c62510a0967108bd6fa9ba7531637e144bdc7450922952079e23509551ce057b3d081accab476d0ee17bb0188d54bc425e8cbcc7a8579c8
SSDEEP

49152:Ol6NEIr9tTtkP1EPcrNDHgB5BzNwui0hBdH3khwapSV:O0NEIbtktESDHgXBquTBpU6b

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe

C:\Users\Admin\AppData\Local\Temp\7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe
"C:\Users\Admin\AppData\Local\Temp\7882604e86c9b81dfadba48453c8e6bcd08ab05f1e40e0be5f2741fce9b32df3.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads