globeimposter | b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c

General

Target

b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
Size

53KB
MD5

7a69f9b67e0459d087532b0604547086
SHA1

66fcba9a08ad08513dd424f5c9a5c0cf5dd3f613
SHA256

b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c
SHA512

e48551c36d552d7bbaee453b158da3e7c25eaa3362e73b7f956fea04eb87d0f62f6d0c10c278b14afc712cbff4356cfc391a7991208c026e6e3584fe4318760d

Score

10^/10

globeimposter persistence ransomware

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe"	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe

Drops desktop.ini file(s) 13 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe

C:\Users\Admin\AppData\Local\Temp\b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe
"C:\Users\Admin\AppData\Local\Temp\b21a282bc1a0013d50ecc6b042faaccea2ad25d1bee3592df76de6ed39e0958c.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing