Analysis
-
max time kernel
122s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 10:00
Static task
static1
Behavioral task
behavioral1
Sample
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
-
Size
53KB
-
MD5
7791c18c9d4a94d80a7928644937c070
-
SHA1
41fca79af1747a862864d2c9114648d6f5404bed
-
SHA256
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539
-
SHA512
81043a21b0e0588b3594210b2339c656d994b72b2787da68a5f433992e054c2bec961e4403997ec846f38862c15a1ff6c5f9faece1b122e838baec759e14f012
-
SSDEEP
768:XZvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5VmXOt:XZeytM3alnawrRIwxVSHMweio3xt
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ShowMerge.raw => C:\Users\Admin\Pictures\ShowMerge.raw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\SkipStep.tif => C:\Users\Admin\Pictures\SkipStep.tif.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\AddShow.tif => C:\Users\Admin\Pictures\AddShow.tif.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\ApproveDebug.raw => C:\Users\Admin\Pictures\ApproveDebug.raw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\BlockComplete.crw => C:\Users\Admin\Pictures\BlockComplete.crw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Users\Admin\Pictures\MoveUnlock.tiff 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\MoveUnlock.tiff => C:\Users\Admin\Pictures\MoveUnlock.tiff.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Deletes itself 1 IoCs
pid Process 1796 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe" 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXT 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00166_.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUP.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ModifiedTelespace.ico 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\EUROTOOL.XLAM 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01149_.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BREEZE.WAV 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN092.XML 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107452.WMF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBLINK.POC 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PAPER_01.MID 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1796 1460 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 29 PID 1460 wrote to memory of 1796 1460 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 29 PID 1460 wrote to memory of 1796 1460 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 29 PID 1460 wrote to memory of 1796 1460 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe > nul2⤵
- Deletes itself
PID:1796
-