bb35c7f98663932ab1f68597d44b59e6a9b5860adadf73d5b1475e7c45a051d7

Analysis

user interaction
yes
max time kernel
24s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mrahc_player.exe
Size 3.8MB
Sample260907-x2kxesstfv
SHA256 bb35c7f98663932ab1f68597d44b59e6a9b5860adadf73d5b1475e7c45a051d7
MD5 fd3165308a8010e4b246c05527c87aeb
SHA1 8b8986b68fa8b35c6b46fe88aa32f1345595985f
SHA512 f3728cc53b10d201e5129fe3ca8dcd7c1b79963788995cad9e12c21263bad6ff0b963061f41bf6af32663ac4bc3611efa71ce7cac076e23dd335a356bff3dc18
SSDEEP 49152:opDxH5dmwhIwpN4CyZThOnUGbSTTLXbxG9bPjVPa5opIU6isi:ON5swhX4OUXM9b50j+si
TLSH
T14D063B43E363C4FCFC29C67493059931BA62BC4958B079AF169877313A73B4215FEA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Colors	mrahc_player.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000e95c517514004c6f63616c003c0009000400efbee95c3c72275db39a2e0000007300000000000200000000000000000000000000000044a8ea004c006f00630061006c00000014000000	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000e95c4d7a100054656d7000003a0009000400efbee95c3c72e95c4d7a2e0000007400000000000200000000000000000000000000000067220800540065006d007000000014000000	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	mrahc_player.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000e95c3c72120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee95c3c72275db39a2e0000005f000000000002000000000000000000000000000000c72fea004100700070004400610074006100000042000000	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	mrahc_player.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	mrahc_player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	mrahc_player.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	mrahc_player.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\NotificationData	mrahc_player.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6092	mrahc_player.exe
6092	mrahc_player.exe
6092	mrahc_player.exe

C:\Users\Admin\AppData\Local\Temp\mrahc_player.exe
"C:\Users\Admin\AppData\Local\Temp\mrahc_player.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6092-0-0x00007FF6E7300000-0x00007FF6E76D4000-memory.dmp

Download

memory/6092-2-0x00007FF6E7300000-0x00007FF6E76D4000-memory.dmp