3ed46144735c63a90aa11123cbcfd11c778564c6f0e38c1100f15dd227a5d05c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FileAssociations.exe
Size

187KB
MD5

9c506d43f84c9152263780f3d915186f
SHA1

062ff6d00dda1e60d7e94fa49fa264f940ba6546
SHA256

4f36716fbd8b9c6b90600037ecf50dcd5fab753bcec864e93e727069b0c4d792
SHA512

3ee300a5b3ca4bf7ede06548fbbb35e4e7433fd795db634a43815e564e2779f9328e949bf1f7d42d0d78816d99665e801dc81d96d13c1da0178650ad135dd39d
SSDEEP

1536:pX8bnEkEAD4V6xyBiPpvjnS5pK5YpN5YUYTv/R2ZvAD4V6xyBiPpvZnS5pK5YpNV:ObnFD4Qxy0Ppv48D4Qxy0PpvKJ

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mkv	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\shell\play	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.ts\ = "SFVIP.ts"	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\shell\play\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sfvip player.exe\" \"%1\""	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts\DefaultIcon	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi\ = "SFVIP.avi"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.avi\shell	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.flv	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u8	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mp4\PerceivedType\ = "media"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mkv\PerceivedType	FileAssociations.exe
Key deleted	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.ts\OpenWithProgids	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\avi.ico\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.flv\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\flv.ico\""	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u8\PerceivedType	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mp4\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mkv\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.ts\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\ts.ico\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts\shell\play\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sfvip player.exe\" \"%1\""	FileAssociations.exe
Key deleted	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.ts	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts\shell	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mp4	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.avi	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.flv\PerceivedType\ = "media"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.flv	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.flv\shell\play\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sfvip player.exe\" \"%1\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u8\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sfvip player.exe\" \"%1\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mkv\shell\play\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sfvip player.exe\" \"%1\""	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.flv\PerceivedType	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.flv\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u\shell\open\command	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u8\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\m3u8.ico\""	FileAssociations.exe
Key deleted	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mkv\OpenWithProgids	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi\PerceivedType	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.flv\shell\play\command	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u8\shell\open	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.avi\PerceivedType\ = "media"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.avi\shell\play	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\shell	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.flv\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mkv\shell\play\command	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\mp4.ico\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon\\ts.ico\""	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mkv\ = "MKV - Play with SFVIP-Player"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.ts\PerceivedType	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u\ = "M3U - Playlist File"	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u8\ = "SFVIP.m3u8"	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u8\PerceivedType\ = "playlist"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u8\shell\open\command	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mkv	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.mp4\ = "SFVIP.mp4"	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.mp4\shell\play\command	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.m3u\shell\open	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u8\DefaultIcon	FileAssociations.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.ts\shell\play	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\SFVIP.avi\ = "AVI - Play with SFVIP-Player"	FileAssociations.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\.m3u\ = "SFVIP.m3u"	FileAssociations.exe

C:\Users\Admin\AppData\Local\Temp\FileAssociations.exe
"C:\Users\Admin\AppData\Local\Temp\FileAssociations.exe"
1⤵
- Modifies registry class
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-0-0x000002BD85800000-0x000002BD85834000-memory.dmp

Filesize
208KB

Download
memory/4988-1-0x00007FFAADE80000-0x00007FFAAE941000-memory.dmp

Filesize
10.8MB

Download
memory/4988-2-0x000002BDA1580000-0x000002BDA1590000-memory.dmp

Filesize
64KB

Download
memory/4988-3-0x000002BDA1580000-0x000002BDA1590000-memory.dmp

Filesize
64KB

Download
memory/4988-4-0x000002BDA38A0000-0x000002BDA38A8000-memory.dmp

Filesize
32KB

Download
memory/4988-5-0x000002BDA1580000-0x000002BDA1590000-memory.dmp

Filesize
64KB

Download
memory/4988-6-0x000002BDA3B70000-0x000002BDA3BA8000-memory.dmp

Filesize
224KB

Download
memory/4988-7-0x000002BDA3B40000-0x000002BDA3B4E000-memory.dmp

Filesize
56KB

Download
memory/4988-8-0x00007FFAADE80000-0x00007FFAAE941000-memory.dmp

Filesize
10.8MB

Download
memory/4988-9-0x000002BDA1580000-0x000002BDA1590000-memory.dmp

Filesize
64KB

Download
memory/4988-10-0x000002BDA1580000-0x000002BDA1590000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads