globeimposter | 78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368

General

Target

78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
Size

53KB
MD5

56be376d428914a73a621182f9a098f0
SHA1

d201d9384cac1c5ca812367ced50033fba1f298c
SHA256

78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368
SHA512

2a9c9be1cbdd37677044f7643f39639ddfe039647fb3c8a347bb7a35b8ff5bb257ce3fa766f74eb7eb7c3db7693169da695949ff179fd5e703d80a45650e26bb

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #1C1A1B; } .letter { color: #FF0000; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter"> <pre>0E 79 01 20 AE EE 0A 53 31 2B B3 21 6C 26 1C DB 9E ED F7 FC 31 EA 27 83 45 0D 4A 16 9F FD 70 26 4C 91 90 D4 07 48 F9 17 C7 BE 68 EC 3C 49 2F FB 0B 73 95 C9 2D 31 EE 2A D8 1A 3F 10 9B F1 C2 EF 20 61 CA 7D 9D B9 B8 56 0A BF 56 55 06 52 80 64 E3 A0 6E AA 0A AF 91 2F 8A F9 6C 7B 40 30 8E 1F 2D 83 57 98 AA F2 EF 24 DE 18 DB 5F FF F5 55 73 24 E3 34 52 66 7C 2B 34 76 81 0F 71 E0 15 18 DF FD ED 8B ED 08 64 88 C1 CB 61 6D 82 D4 76 64 14 B5 65 07 2B CF D4 D2 B4 4E DA 94 99 4F 03 0E 2D 75 2F 71 B7 25 01 A0 CF 37 81 69 CF 22 BF E4 ED 3B B3 66 76 C3 A8 87 B4 9F D5 74 10 D2 AD 39 F4 F9 EF D9 30 21 EB EB C3 9C 95 48 B8 BE 8D F0 5C 7A 4B 3E 67 FB 1F 17 3E DC 4D 6C 1C 75 44 8E 30 0A 41 A7 DA ED 26 B9 6B 13 84 05 E1 97 EC 76 4E 1F 7E 14 F9 E6 83 F7 53 8A 2A E6 28 EC 3B 32 FF </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760 Your files are encrypted! &#9760</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text">  To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file as proof and assign the price for decryption all files.<p></p> After payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <center><b><p style="color: #ffff66;">MOST IMPORTANT!!!</p></center> <hr color="#ffff66"> <center><p style="color: #ffff66;"> We are ready to work through intermediaries and guarantors. </b></p></center> <hr color="#ffff66"> <ul> <li>Only sambuka_star proof can decrypt your files.</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data.</li> <li>Decoders other users are not compatible with your data, because each users unique encryption key. </li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html> ��

Emails

[email protected]</span><br>

class="letter">[email protected]</span>)</p><p>

URLs

http-equiv="Content-Type"

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\GetSuspend.raw => C:\Users\Admin\Pictures\GetSuspend.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\ResolvePush.raw => C:\Users\Admin\Pictures\ResolvePush.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\RestartApprove.crw => C:\Users\Admin\Pictures\RestartApprove.crw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\UnprotectConfirm.raw => C:\Users\Admin\Pictures\UnprotectConfirm.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\SyncPing.raw => C:\Users\Admin\Pictures\SyncPing.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\UnlockRevoke.raw => C:\Users\Admin\Pictures\UnlockRevoke.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Pictures\ApproveNew.tiff	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\ApproveNew.tiff => C:\Users\Admin\Pictures\ApproveNew.tiff.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\CompleteRead.png => C:\Users\Admin\Pictures\CompleteRead.png.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\GroupUninstall.crw => C:\Users\Admin\Pictures\GroupUninstall.crw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\SplitConnect.raw => C:\Users\Admin\Pictures\SplitConnect.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File renamed	C:\Users\Admin\Pictures\SuspendStart.raw => C:\Users\Admin\Pictures\SuspendStart.raw.FORESTGUST	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe"	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe

Drops desktop.ini file(s) 23 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4492	svchost.exe
Token: SeCreatePagefilePrivilege	4492	svchost.exe
Token: SeShutdownPrivilege	4492	svchost.exe
Token: SeCreatePagefilePrivilege	4492	svchost.exe
Token: SeShutdownPrivilege	4492	svchost.exe
Token: SeCreatePagefilePrivilege	4492	svchost.exe
Token: SeSecurityPrivilege	3180	TiWorker.exe
Token: SeRestorePrivilege	3180	TiWorker.exe
Token: SeBackupPrivilege	3180	TiWorker.exe

C:\Users\Admin\AppData\Local\Temp\78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe
"C:\Users\Admin\AppData\Local\Temp\78e972669fff152cdd54923993eb98486c347c5a36c9abe733390b1f65785368.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-130-0x00000234F5FA0000-0x00000234F5FB0000-memory.dmp

Filesize
64KB

Download
memory/4492-131-0x00000234F6520000-0x00000234F6530000-memory.dmp

Filesize
64KB

Download
memory/4492-132-0x00000234F8C20000-0x00000234F8C24000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing