72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Size

521KB
MD5

8fe791bc88e46b98edaad3283b02f62c
SHA1

826029ad6074486d061090780ad7a2a338ef90e0
SHA256

72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a
SHA512

33e139b44fadaa7d1c48a7170f5ecd8b226ed4a16bc5022e1c38b2772c44f6692bd6c76b67a5cf21d0dccbd64cd881264f8a07abc7e98ae126a89de50d3115ef
SSDEEP

12288:Xdc6bJHwtVQWe+PZRdmAULlEG1Ose0wMMMMMMzh:X66bJHwtJeERdZ8a0wMMMMMMz

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR ???"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR ????"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP ????"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe

C:\Users\Admin\AppData\Local\Temp\72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe
"C:\Users\Admin\AppData\Local\Temp\72ffb9535365ab374396b0a1bea302ed8ebd95b724907144beedb7d82728773a.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Filesize
982B

MD5
19673edfb7f6428015aa0899ecf7414d

SHA1
a2529f551ce8eaf6a2e45bda0c73f51bca29be8b

SHA256
a9f0049c178942ea8753e3e9cb49cbec7f5a48ceaf8d94b9fec58bb272f31dab

SHA512
f8ba3b4fc834c61ffed082a5e2f74beab6117a9c0bed4b3431b27f91080a1617a8b1de9188ccd44b7f2a36d208d82e0073ff832a8690018237f70e0507ff50a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

Filesize
942B

MD5
fca8a55921b396f7782cef870d7969a1

SHA1
e13c9ffc8858b4565901a31a04c667eb8f3cb3a6

SHA256
a4330ca8ae55e418227d887bab072143a4c6d48644b462d5b479852299b519a5

SHA512
e661caa9442d213fd44c6823cfe84e62640a96bdc52b9674fee740bbc34b56979d4c512d53c06627c13a02647dc3770226047dfa27f46d875a5fa287316c98ea

Download Submit
memory/2204-23-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-28-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-6-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-3-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-14-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-19-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-0-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-9-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-33-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-36-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-41-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-44-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-49-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-54-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/2204-57-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads