Overview

overview

10

Static

static

3

7b65b6bdd6...18.exe

windows7-x64

10

7b65b6bdd6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118

  • Size

    220KB

  • Sample

    240528-c21bwscg46

  • MD5

    7b65b6bdd6866345d6f9d0e18a0dcbc9

  • SHA1

    fe3fdda918a3db1b17fc48716b574356700d5fc0

  • SHA256

    2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274

  • SHA512

    0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1

  • SSDEEP

    3072:93VrTNNer1tXqjkJ+G0vskV+Rr/wtBMHD4C6S7FSrK3xn9j0J:tV/MvJaL+lItqISxMGxh0

Score
10/10
globeimposterdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      7b65b6bdd6866345d6f9d0e18a0dcbc9_JaffaCakes118

    • Size

      220KB

    • MD5

      7b65b6bdd6866345d6f9d0e18a0dcbc9

    • SHA1

      fe3fdda918a3db1b17fc48716b574356700d5fc0

    • SHA256

      2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274

    • SHA512

      0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1

    • SSDEEP

      3072:93VrTNNer1tXqjkJ+G0vskV+Rr/wtBMHD4C6S7FSrK3xn9j0J:tV/MvJaL+lItqISxMGxh0

    Score
    10/10
    globeimposterdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (8675) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks