Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 10:05
Static task
static1
Behavioral task
behavioral1
Sample
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
-
Size
918KB
-
MD5
114919557a1234b2447f9ec0f671aff0
-
SHA1
517bbe94df5665999dfc646653f4a162237543c1
-
SHA256
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e
-
SHA512
bb0e1e3c422d7c3f9fb1c0dca9122d23c8f9a8d9092c1cae0835704d135c2af537d48fcd427d6d4b4437394091be442f5deb17b28e572f6f169113a426881410
-
SSDEEP
24576:hiryaFQUU3eYJbXiclcOM6EhmEL6a9E5ark:kFltc50mx5ark
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "12208" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "12208" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "11848" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11861" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "12208" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "11848" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "11861" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "11861" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11848" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 856 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 856 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe 856 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe 856 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe"C:\Users\Admin\AppData\Local\Temp\93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:856