04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Size

1015KB
MD5

cc730ac556450b257d6bbede5c336116
SHA1

d2fb790e3c959b0eefd508692591f170d9b9353c
SHA256

04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05
SHA512

cd6aca01dcbe0e319db3aba1c43096d144cef918115d9b62b43e03b53e073ffd9d1f7711c4f1261146eb3ba6e0529594212fa18c98b5a20e3e9b14ee12f86d2a
SSDEEP

24576:fKG+6WC0IBOw0DWlyvZnTQYuGJ2UMMMMMMb6:KovBOrPnTQYtMMMMMM

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP ????"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR ????"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR ???"	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe

C:\Users\Admin\AppData\Local\Temp\04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe
"C:\Users\Admin\AppData\Local\Temp\04d330a4455b8504fe3fd77bf7f443df857436340e00e3f60dce09fdfd1c7c05.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads