Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
-
Size
918KB
-
MD5
114919557a1234b2447f9ec0f671aff0
-
SHA1
517bbe94df5665999dfc646653f4a162237543c1
-
SHA256
93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e
-
SHA512
bb0e1e3c422d7c3f9fb1c0dca9122d23c8f9a8d9092c1cae0835704d135c2af537d48fcd427d6d4b4437394091be442f5deb17b28e572f6f169113a426881410
-
SSDEEP
24576:hiryaFQUU3eYJbXiclcOM6EhmEL6a9E5ark:kFltc50mx5ark
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3631" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3644" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3644" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "71" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3644" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TypedURLs 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "60" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3631" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "4098" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "4098" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "57" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3631" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "4098" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "49" 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{B501350E-1C60-423A-8788-B8B4933CB6A1} 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe 488 93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe"C:\Users\Admin\AppData\Local\Temp\93bcb49ff5a6f210d9a16fa2143f0e765528541ed267f540b15eaf33a8630c9e.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:488