Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10samples (2) (3).zip
windows7-x64
1samples (2) (3).zip
windows10-2004-x64
1100b8bfff5...48.exe
windows7-x64
1100b8bfff5...48.exe
windows10-2004-x64
116b5122423...49.exe
windows7-x64
716b5122423...49.exe
windows10-2004-x64
72727dde741...98.exe
windows7-x64
92727dde741...98.exe
windows10-2004-x64
929dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
93c5ffe21fd...017.js
windows7-x64
13c5ffe21fd...017.js
windows10-2004-x64
148493bb68b...20.exe
windows7-x64
1048493bb68b...20.exe
windows10-2004-x64
10568a79ce58...19.exe
windows7-x64
9568a79ce58...19.exe
windows10-2004-x64
957de0d2d59...fe.exe
windows7-x64
957de0d2d59...fe.exe
windows10-2004-x64
75e34ceeaf6...05.exe
windows7-x64
15e34ceeaf6...05.exe
windows10-2004-x64
16e2db44578...ac.exe
windows7-x64
96e2db44578...ac.exe
windows10-2004-x64
975342ada93...76.exe
windows7-x64
875342ada93...76.exe
windows10-2004-x64
67e623dca8a...e2.exe
windows7-x64
107e623dca8a...e2.exe
windows10-2004-x64
1087f2db714e...7e.exe
windows7-x64
887f2db714e...7e.exe
windows10-2004-x64
88dcb1af1e7...b0.exe
windows7-x64
78dcb1af1e7...b0.exe
windows10-2004-x64
7Analysis
-
max time kernel
185s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 15:12
Behavioral task
behavioral1
Sample
samples (2) (3).zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
samples (2) (3).zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
2001.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
2001.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win10v2004-20231222-en
General
-
Target
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
-
Size
53KB
-
MD5
13bfc9705ee633aec38f4ccffdca471c
-
SHA1
bfa8395e872262b95bb218b9834edd90ab2cff5e
-
SHA256
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420
-
SHA512
c900e5dd21c35c2ff875b3d209bff0da0d52468d48dc17324401f5646bf7bdcbeec460085e8abad222dfb30bd85e2c3d214dce80e2de567cb6ddee217999be6e
-
SSDEEP
768:1xPUSvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5NID:1lHeytM3alnawrRIwxVSHMweio3jI
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe" 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe -
Drops desktop.ini file(s) 10 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-635608581-3370340891-292606865-1000\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Videos\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Music\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe File opened for modification C:\Users\Public\Documents\desktop.ini 48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD547661d645d751793b4c7c4d9a552f71e
SHA113ca89a2d4618511f386cb07e5731a936eb8ab32
SHA256da3103678faccd33edd1e9b9506d43502e7666d16f113ed5b2b7c2d6f1e850aa
SHA512f94041f6ae12d3d4aec5d5e749168e164a3d197d21b3574f2882ed01052e77ef6586d145e6c924ee44815c0c203c48b4c654a1f81077324c9d586c10ae3653b5