Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11/02/2022, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe
Resource
win10v2004-en-20220113
General
-
Target
949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe
-
Size
55KB
-
MD5
f03c20c441616c094e63581190f4c168
-
SHA1
9a060b80722b3060d238e15667db799f8e86f66b
-
SHA256
949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff
-
SHA512
4332046ab41812240c2c7bb73bedbf75b10571446305a98f9c7b971fcb8baaf99e14f636a754b60701bed25e0e48e822361b21bdd1ffbb5ed8960a65ca24aafd
Malware Config
Extracted
C:\how_to_back_files.html
class="mark">[email protected]</span>
class="mark">[email protected]</span>.</br>
class="mark">[email protected]</span>
class="mark">[email protected]</span></li>
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe" 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe File opened for modification C:\Users\Public\desktop.ini 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe File opened for modification C:\Users\Public\Videos\desktop.ini 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe"C:\Users\Admin\AppData\Local\Temp\949f69d9f5f032e9b0a9370852ab8528bc810bb89dadbd09ac41206e2a6391ff.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:5088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:2496