globeimposter | 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920

General

Target

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Size

167KB
MD5

612974dcb49adef982d9ad8d9cbdde36
SHA1

b817e361bd0cc1819d7f6a1189f0f5d56ed48721
SHA256

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920
SHA512

84d5acbb8f258683bb6735539e368c2823218d2a6cf07222a50e1e026e3a0aca092941110e87b1d38a601c6a1e3d54604c2f4241c3ec265ed0bf25140a14c2fc
SSDEEP

3072:Vzm96ax+qLT5+IqRRztaWEmJLhSpTGqbay/0TwEz:VS96axL5kxHP0hmy/4z

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ClearExport.raw => C:\Users\Admin\Pictures\ClearExport.raw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\EnterOut.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\EnterOut.tiff => C:\Users\Admin\Pictures\EnterOut.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\InstallSearch.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\JoinSwitch.tiff	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\ResolveWrite.crw => C:\Users\Admin\Pictures\ResolveWrite.crw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\InstallSearch.tiff => C:\Users\Admin\Pictures\InstallSearch.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\JoinSwitch.tiff => C:\Users\Admin\Pictures\JoinSwitch.tiff..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File renamed	C:\Users\Admin\Pictures\MeasureComplete.raw => C:\Users\Admin\Pictures\MeasureComplete.raw..doc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Drops desktop.ini file(s) 29 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Drops file in Program Files directory 64 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MSTHED98.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\TWRECS.DLL	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02389_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VisioCustom.propdesc	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO98.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ.POC	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PAPER_01.MID	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXT	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01149_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hu.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02134_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18206_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03466_.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\Read___ME.html	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPDESIGN.DLL	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205462.WMF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

pid process

1288 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

pid	process
1288	13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe

C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe
"C:\Users\Admin\AppData\Local\Temp\13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1288

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Videos\Sample Videos\Read___ME.html
Filesize
4KB

MD5
c23d0dc362feb929681b80ecbc32249a

SHA1
4d0839815f77ec716a0cad6e347f5cac7a316bb9

SHA256
d1c1e33cd522457d62aa0ad83a7aeac4d23e1bac42e3a50f86781fad3d9dc01e

SHA512
4f1b2fab0a626b8cd51c4f589b37f604d623725bb98fb1001ccc5bd93b962f0839a653e8aa2e6d5f2680c57e61a3866039533223324a4c178b70567f5cd0351b

Download Submit
memory/1288-757-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads