Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe
-
Size
918KB
-
MD5
0f524131aa1f05243a98a6b59a1618a0
-
SHA1
7455e7c16cfdfeac258e3547190803f513cddc35
-
SHA256
5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721
-
SHA512
46f51360455fd1f7e2c0bec5e2bd1e34ac0bec068e7da6a41fc67c9ed608d7683e549f672361c2d408de8add61551de5d4721ac41e3580ea43e29c86cb45edda
-
SSDEEP
24576:hiryaFQUU3eYJbXiHlcOM6EhmEL6a9E5ark:kFltH50mx5ark
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "89" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TypedURLs 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "40" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "43" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "43" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "111" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8166" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "488" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "48" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "45" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8179" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8179" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "75" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "111" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "97" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "89" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "89" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "488" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "40" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "40" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "9006" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "9006" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "48" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8179" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8166" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "45" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "45" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "75" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "97" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "9006" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "488" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8166" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "43" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "75" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "97" 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{FD4C74BE-7B84-4144-BE55-75421C2A48CE} 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe 2748 5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe"C:\Users\Admin\AppData\Local\Temp\5208dc9c28292022663129641cafbd8c908d4f03cbb1984c9dfd234e475ac721.exe"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748