Analysis
-
max time kernel
186s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:43
Static task
static1
Behavioral task
behavioral1
Sample
8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe
-
Size
97KB
-
MD5
74dfac6a06795a4a0eed158f47eead7b
-
SHA1
4a7652bc69385e4bb120b733c00b0f6ea5a8eb2a
-
SHA256
8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323
-
SHA512
6e3a10f1f6d96e2fa503bebbcc12d3c93681afe1ea7e577bffb33f9e029284238e263ce273a7302b56a08d663ba71593af3037baeee948f5c8ac163275b7549c
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2276 created 856 2276 WerFault.exe 97 -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DismountClear.tiff 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe" 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe -
Drops desktop.ini file(s) 13 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Videos\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Documents\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Music\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2512 856 WerFault.exe 97 3640 856 WerFault.exe 97 -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2257" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5727" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2257" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5727" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2257" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5727" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1944" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe Token: SeRestorePrivilege 1676 TiWorker.exe Token: SeSecurityPrivilege 1676 TiWorker.exe Token: SeBackupPrivilege 1676 TiWorker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 856 SearchApp.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2276 wrote to memory of 856 2276 WerFault.exe 97 PID 2276 wrote to memory of 856 2276 WerFault.exe 97 PID 856 wrote to memory of 2512 856 SearchApp.exe 103 PID 856 wrote to memory of 2512 856 SearchApp.exe 103 PID 856 wrote to memory of 2512 856 SearchApp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe"C:\Users\Admin\AppData\Local\Temp\8b94ad2dafddd71f66023a87efce42f88aa2a3e0183a5a5d02eb7a8329ed2323.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 856 -s 45122⤵
- Program crash
PID:2512
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 856 -s 45122⤵
- Program crash
PID:3640
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3140
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 856 -ip 8561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2276