7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Size

1.1MB
MD5

a1a9961852af6688d1eaa9863a35ca60
SHA1

47158e5c556f1c7f359d0e042f6ae15f7782f284
SHA256

7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5
SHA512

616b0155e78cb079f4173cb73a7dba95b7088c77c0e358a180fa511bb21cbd8402c16a07ac60a9fef992fe6cb813c4ba11895f982f1d658284482d8689b6d662
SSDEEP

24576:gAkS+8qyb7h9RHyevHQfsXQazAnMMMMMMww5x:gM57h9RH/HUQQa+MMMMMMB

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe

C:\Users\Admin\AppData\Local\Temp\7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe
"C:\Users\Admin\AppData\Local\Temp\7a4c5891e396975bea5bcdea7de594ced55198789f566480522b613086ff82b5.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000000C90000-0x0000000000E17E00-memory.dmp

Filesize
1.5MB

Download
memory/1732-8-0x0000000000C90000-0x0000000000E17E00-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads