Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11/02/2022, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe
Resource
win10v2004-en-20220112
General
-
Target
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe
-
Size
55KB
-
MD5
b89f0f1f9397ece683ae76d9cfa02973
-
SHA1
1bdb10e24abf15bd1c8e74a95321acb0ca22ea52
-
SHA256
ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a
-
SHA512
a24840da73a223d359cb9f39aba77f8d21ca67b13e5242dd81c69be2a7617c6d749a317d1ce3de24d357e4a31053fc7ba059dce0f71ee2e6b1f810abadd77816
Malware Config
Extracted
C:\HOW_TO_BACK_FILES.html
http-equiv="Content-Type"
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe" ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe File opened for modification C:\Users\Public\desktop.ini ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe File opened for modification C:\Users\Public\Videos\desktop.ini ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe -
Kills process with taskkill 1 IoCs
pid Process 1680 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1540 ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1680 taskkill.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1680 1540 ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe 27 PID 1540 wrote to memory of 1680 1540 ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe 27 PID 1540 wrote to memory of 1680 1540 ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe 27 PID 1540 wrote to memory of 1680 1540 ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe"C:\Users\Admin\AppData\Local\Temp\ae285765a21021576ce21c43fb549c97e9a2673b2a1291e1b1c77b4c918b130a.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /PID 15402⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680
-