Analysis
-
max time kernel
124s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-02-2024 14:09
Static task
static1
Behavioral task
behavioral1
Sample
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
Resource
win10v2004-20231215-en
General
-
Target
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
-
Size
53KB
-
MD5
22ff4b883468f0b2b21b2c50d5ca5bd9
-
SHA1
e34f09cf8f1416ab4611a6a18ff99281fad93c70
-
SHA256
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893
-
SHA512
9b37dff34d3ceca993bebda8e6d3f4f4a361af65ec6bdde4be54021be2dc48c176aa0b0ef2bae8433ca2957d5e3c28fe448465c3f816a5ee36a5d395bd8f4405
-
SSDEEP
1536:oWOeytM3alnawrRIwxVSHMweio36l990:oWOey23alnaEIN/W6lA
Malware Config
Extracted
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Renames multiple (7520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2200 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe" d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\how_to_back_files.html d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00011_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9 d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMAIL.CFG d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0168644.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePage.gif d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\how_to_back_files.html d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185800.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Status.accft d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Events.accdt d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.DPV d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_increaseindent.gif d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02794_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152708.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02886_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\how_to_back_files.html d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02267_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_ON.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR19F.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00732_.WMF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\how_to_back_files.html d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AU.XML d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exedescription pid process target process PID 2480 wrote to memory of 2200 2480 d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe cmd.exe PID 2480 wrote to memory of 2200 2480 d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe cmd.exe PID 2480 wrote to memory of 2200 2480 d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe cmd.exe PID 2480 wrote to memory of 2200 2480 d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe"C:\Users\Admin\AppData\Local\Temp\d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe > nul2⤵
- Deletes itself
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57404b23a26e69c3aeabc714f8bddd9f9
SHA12c8af615983f1891c30e2187f40c05f3b2b25a36
SHA2565a1cd366af88081b192bebde515e8bb11588de87f6823152ab07413e9f7dc638
SHA512c62c1a6ae716047a398cb20ad746be87024407a82ee6d1b59ea669510f83cfe540071f31c4661acf58f6d52a4a7640897b5212e30dbcdf60e8fc3cf788600851