008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Size

1.1MB
MD5

6d86b1179eb75403c7589b8791ed25e8
SHA1

19e4a0aa09ffcb53e67be5d8356513e6f012547d
SHA256

008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d
SHA512

7d64a43938b05ebc98e0b83a10a0b6ca4543459b8c3e4100d8b26378212713b012816fa432322d8bf1eac5657c28c4017868fd4ba21380b8cbd877ffae6c8d08
SSDEEP

24576:bqyOPKc3UPvEqGLiit8TFxw+xhwe7A8hVnMMMMMMbAQ:HEHMEjLiiifxOe7A4tMMMMMM

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe

C:\Users\Admin\AppData\Local\Temp\008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe
"C:\Users\Admin\AppData\Local\Temp\008d7ae8a2db540625131ba334d003df80a578ce3a692ee56719a1d11eb6629d.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000000810000-0x00000000009CE000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads