Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 14:43
Static task
static1
Behavioral task
behavioral1
Sample
c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe
-
Size
918KB
-
MD5
04f162131648e13919f5c6fa030dfd90
-
SHA1
7ad326450d6070668f1c033d3aa4b02119bb63ae
-
SHA256
c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27
-
SHA512
cc24f08b191101ec345347e1601805f0927d18228bc9621ef5d3a0a732a5b2fc9f14fd1c6f3733798bdabed6361f6aa1336bcef46eda2b36ecc45f17b4db6b15
-
SSDEEP
24576:hiryaFQUU3eYJbXiolcOM6EhmEL6a9E5ark:kFlto50mx5ark
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "60" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "9958" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "12385" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "12385" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "11198" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "13923" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "57" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "71" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "11198" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "12385" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "9945" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "10412" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "10412" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "9945" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "11198" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "13923" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "57" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "60" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "49" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "71" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "9958" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "10412" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "9945" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "9958" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "13923" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "49" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TypedURLs c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "57" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "71" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "60" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "49" c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{3DEEF34A-D1C5-4E64-990C-DD66AC03F344} c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3752 c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe 3752 c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3752 c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe 3752 c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe 3752 c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe"C:\Users\Admin\AppData\Local\Temp\c9bebe83815c3db4fe8d1807dbfacb2bbaf7743345121f0b9278819519171b27.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3752