Analysis
-
max time kernel
4294179s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
02-03-2022 16:41
Static task
static1
Behavioral task
behavioral1
Sample
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe
Resource
win10v2004-en-20220113
General
-
Target
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe
-
Size
167KB
-
MD5
d4ddf8bfcc057fcfece2a498942079ce
-
SHA1
b52e239c775781b1c569d246c88727573ba5904b
-
SHA256
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc
-
SHA512
b647204be207866441774175248acd7ff7cc036b3616ac20ec45901369236fdfb5565bc127c89bd1bf7af02be4a98a7a5396aed910b928dd1df6f2133cc67243
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe" 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1108 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exepid process 1208 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1108 taskkill.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exedescription pid process target process PID 1208 wrote to memory of 1108 1208 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe taskkill.exe PID 1208 wrote to memory of 1108 1208 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe taskkill.exe PID 1208 wrote to memory of 1108 1208 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe taskkill.exe PID 1208 wrote to memory of 1108 1208 7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe"C:\Users\Admin\AppData\Local\Temp\7bc1c0b67e76b761128ffc478554858a09aa6e5fbb7e57f1f58b3066f6c228fc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /PID 12082⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108