8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Size

1.1MB
MD5

965ae505bc88454f38a673208a263948
SHA1

955f7eb9c71adde22337aa6222e2b2271de345f8
SHA256

8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321
SHA512

40a78ed10fa243eec8063eea13f91233027896a8995502625b30f32967f6a78e813ac72002de951dd475cc5c6ca280927825739df8f6f574844852d709036570
SSDEEP

24576:sd41wIxFYo+XywXUsVbxXYuouO2FKnMMMMMMOhs:vLSiwXUsLDokWMMMMMMH

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR32	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1308	8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe

C:\Users\Admin\AppData\Local\Temp\8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe
"C:\Users\Admin\AppData\Local\Temp\8ef42803f1335e9aca458546037e2cffea216ee5b89cc8940e331632ce0db321.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-0-0x0000000000B30000-0x0000000000CA1000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads