Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    183s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    11/02/2022, 06:37

General

  • Target

    b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe

  • Size

    53KB

  • MD5

    7a69f9b67e0459d087532b0604547086

  • SHA1

    66fcba9a08ad08513dd424f5c9a5c0cf5dd3f613

  • SHA256

    b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c

  • SHA512

    e48551c36d552d7bbaee453b158da3e7c25eaa3362e73b7f956fea04eb87d0f62f6d0c10c278b14afc712cbff4356cfc391a7991208c026e6e3584fe4318760d

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
    "C:\Users\Admin\AppData\Local\Temp\b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    PID:3836
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:384
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:208

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads