3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Size

1.1MB
MD5

6d13b002508fae94b29d1847cec9de5e
SHA1

f3f1c6df4963617c7add237a60515a001cd40819
SHA256

3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b
SHA512

367b820985e80d8cd3c4cc701648b06583d51e648d78099489408e2ca81bbcf23e6f26897e6a655a9de51d6038e0106edbbf7a095cdf4727077c4bf8fe55a287
SSDEEP

24576:QAkS+8qyb7h9RHyevHQfsXQazAnMMMMMMww5x:QM57h9RH/HUQQa+MMMMMMB

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3776	3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe

C:\Users\Admin\AppData\Local\Temp\3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe
"C:\Users\Admin\AppData\Local\Temp\3f0eb93b529f5f583f0ada4b27582ee52b859b86203cfe8b128aa0f9b6a24a4b.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3776-0-0x0000000000210000-0x0000000000397E00-memory.dmp

Filesize
1.5MB

Download
memory/3776-8-0x0000000000210000-0x0000000000397E00-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads